I think the last point, authenticated metadata, is the most interesting.

In fact, I think it's how web sites like Facebook should have been designed. Rather than "handing over" personal information, each site should receive binary blobs identified only by purpose (e.g. "E-mail address", "photo #3 of gallery 2"). The data could be a copy, an entry in some public registry, or a URL. Facebook can then decide when it wants to send this information to the web browser (e.g. when someone tries to view your photo gallery), and the only way to actually render the blob is with an appropriate decryption key on the client side. The encoding could include other trust factors, such as expiration dates that would make the images impossible to view even with a key.