As far as I can make out, this isn't distributed --- while there may be multiple file servers, each piece of data is stored on exactly one file server, and you

As far as I can make out, this isn't distributed --- while there may be multiple file servers, each piece of data is stored on exactly one file server, and you need to use the directory service to allow you to identify which file server stores the data. Then you contact that file server and it's a perfectly ordinary remote file system. It sounds like it ought to be nigh-trivial to bolt IPFS support onto it, so that the file server is replaced by IPNS (can't be IPFS because Upspin is mutable). So, you look up elvis@theking.com/fnord and the directory server hands you '<hash>/fnord', and the client library then goes and looks up the data via IPNS. No file servers required. Of course, this means that the only way of doing ACL enforcement is via encrypted data which is unlocked via ephemeral keys handed out by the keyserver, which as a solution is pretty terrible, but ACL enforcement in a decentralised system is practically impossible anyway.