For the record this is only the First Public Working Draft. A lot can and will change. We are looking for commentary to understand if we are on the right track
This argument is made by those that are completely satisfied with their design. A little engineering knowledge on their part could never make the design even better. no, never!
I'll toot my own horn and say that I saw the writing on the wall 4 years ago and moved to Ubuntu. Best decision ever. I lack for nothing. Apple is the new Sony - no thanks.
The encryption should really take place in a scope that content JS cannot access. I also think a system like this should be built completely parallel to email systems. Email is crap and needs to be re-invented as a web app with pseudo-anonymity and Public Key Encryption on by default. Users should not even know they are using encryption.
Working on this exact problem myself: https://droplettr.com - the encryption uses Firefox Sync crypto module in an extension, so the crypto is done by the browser outside the scope of content JS. The rest of the app is pure JS and HTML, with a Python/Django REST-style server.
The Diaspora crew came to my company and gave a talk. It was pretty boring actually. They ARE NOT interested in cryptography in the first place. The only crypto going on is SSL. Whoopy-doo-dah.
If they wanted to actually solve a problem they could have tried to make this system pseudonymous, with all social graphs, user data and messages encrypted. Oh well.