> The platform does not have a user-engagement incentive.
Then you lose to a platform that does. There does need to be a level of incentive for user-engagement. Either that or users will invent one.
> Personal network sizes are restricted. You can't be "friends" with everyone. Adding friends perhaps comes at some cost or is just strictly capped.
Facebook is capped at 5000 connections where a connection is defined as a friend or page like. You can argue whether or not this should be a smaller number, but technically Facebook does have this.
> Sharing outside your friends network from the platform is not possible. This platform is for sharing with your friends, not the world.
What about Friend-of-a-friends? How do two people find out they're both on the platform? Some information has to be publicly available. I think if you stop making "public" an option, users will just find some way to make things more public. Like sharing images via avatar image. Or taking screenshots and passing those among their friends (and their friends share with their friends, etc).
> Trust in the platform and how it shares your data. The easiest way to trust the server is if everything is E2EE, but we all know that's not trivial. Perhaps the limits in scaling E2EE can work synergistically with (2) and (3)
Eh. End to end encryption only matters for information you want to be kept private. And the information isn't being shared between you and me, it's being shared between Facebook and me, then Facebook and you. The problem is that Facebook is the one selling the data. It's the fact that they're the hub.
It's a hard problem all over because in a lot of places, you're fighting human nature.
Maybe a P2P/torrent style system, where all the information is encrypted and your data exists as a hash. To contribute to that hash, you need the private key, to read that hash, you need the public key. Connections are made by swapping public keys with people. You'd need a way to get your own private key from some source if you want to use multiple platforms. But if the private key was stored in some central hub, but encrypted, you could request the encrypted private key and then use your password/phrase to decrypt it on your device.
Just spitballing.