In reality.
Knowing that they have millions of customers, and that they have invested years of work into their current infrastructure.
So, playing devil's advocate for the moment --- and taking the above facts into account --- what, precisely, would you do in their position?
Granted, they can still steal your password...
You are now Drew. You start this morning by visiting Hacker News. "Dear god," you exclaim, "I've been such a fool! We've been Doing It Rong all these years!"
Inspired by this new revelation, you spring out of your chair and out the door. You stride into "The Programmer Pit" and over to the new hire, backhanding him across the face. "Get the hell off of Portal 2! We have work to do! Jessica, go pick up four cases of Red Bull --- It worked at MIT, it'll work here."
Now that you have Acquired Their Attention, you say, "Okay, here's-a what we gonna do. Step 1: Jimmy, I want you to ..."
... Now. What, exactly, fellow HNers, is Step 1? Fill in the blank.
What, step-by-step, do you want Dropbox to do?
Maybe they don't need to do anything else. Dropbox is a fine service as it stands; security must be traded off against convenience, and the trade-off that Dropbox makes is acceptable to lots of people. They do have a responsibility to make sure that those people understand the trade-off, though, as well as a responsibility to admit that they've swept important details under the carpet in the past.
The only way Dropbox could access those files then would be to backdoor the Dropbox client. But if they were going to do that, it wouldn't even be safe to use TrueCrypt or GnuPG either.
ecryptfs isn't a suitable alternative to my suggested solution which would involve all Dropbox clients having the capability built in. Of course, people who are really paranoid can use their own layer of encryption on top as well/instead.
"Our goal is for no single employee acting alone is able to access your files. However, there is a procedure where multiple people working in concert can recover your files and provide them to law enforcement. Unfortunately, it is possible for a hacker / programmer to create a backdoor and there is nothing we can do about this."
Encryption is always a trade-off, since it introduces the possibility of total data loss if the key is mismanaged.
That depends on the law. Is it legal in the US to store someone else's strongly encrypted data on one's server? Assuming it is, then they should encrypt by default and then if law enforcement forces them to give up data, give what they have.
Personally, I'd let them off the hook if they admitted their previous deception and explained the limitations of their security model in terms that any user can understand.