The discussions we've had so far about threat models highlight the difficulty of finding a threat model which results in a system which is plausible. Anyone want to have a stab at describing idealised model of what one is trying to achieve with censor resistant distributed file systems, without tying anything back to implementation ideas. Adam