If you want Facebook's computers to automatically take down any copies of the photo, yes, you're going to have to trust them with a copy of it.
Automated DMCA takedowns of copyrighted music and movies work in very much the same way.
No. They could have you compute a fingerprint locally without uploading the image itself, preferably through some audited open source software, without auto-updates. They only don't do that because they want to guard their image hashing as corporate secrets.
if there is no match you gave them no data of interest. if there is a match then they already have that image anyway and you didn't make your privacy situation worse, except maybe telling them that you claim that is you, now allowing them to associate more images was you, but that's probably an acceptable tradeoff if there is actual revenge porn of you out there.
Regardless, I think your point stands.
If they don't have it, but are doing verify-after, then the image won't actually be blocked right away. The proposed system would be of pretty marginal value. Some value, yes, but low enough that facebook decided it wasn't worth building that system.
You can't avoid having a tradeoff somewhere.
one downside: i think this could allow a bad actor to directly observe the fingerprinting and assist in developing a method to defeat it.
That's what is missing from the internet, generally speaking. Services like public notaries. That's kindof what CAs provide. But there are a lot of similar services that could exist for things like this.