Surely your "friend" can choose to run a node that conforms to the Diaspora protocol, but also forwards your information on. How does the trust/privacy aspect work?

You know, the same kind of friend that uploads photos of you drunk.