I read through the IOTA whitepaper a while ago, and while I find the general idea of a DAG-based approach interesting I wasn't able to understand their trust concept or even basic implementation details of their consensus algorithms (which are not detailed in the paper).

As an example, one of their core claims is that it's possible to do offline transactions on a tangle (=DAG) that is isolated from the main tangle and that can be merged later. What I didn't understand is how they resolve the double spending problem with this: If two devices create valid transactions on two independent subtangles and the system tries to reconcile these tangles into the main tangle afterwards, how do they determine which transaction is valid?

Also, I could never get my head around the idea of a decentralized IoT data marketplace. I mean, it really sounds catchy but when you start thinking about possible applications it's actually quite hard to come up with something that seems both interesting and doable.

Finally, no one seems to think about the privacy implications of having IoT data (which often is person-related or person-relatable and therefore under the protection of the GDRP) on a decentralized system where you basically lose control over the data the moment you upload it. From a data protection perspective this is an absolute nightmare.