I think it would be better to use existing federated protocols for this, such as e-mail or Jabber/XMPP, rather than trying to jam it into OStatus. Typical problems with doing privacy-anything over the Web also apply