This. I was thinking of exactly this solution while reading this whole discussion but was unable to express it clearly. Basically, if a user's 'tree' is encryp

This. I was thinking of exactly this solution while reading this whole discussion but was unable to express it clearly. Basically, if a user's 'tree' is encrypted with his password, I don't think anyone can identify who has a particular file. It does allow to revoke the file for everyone in one operation though.