The person-specific context approach is the right framing for privacy — not encryption at rest, but structural isolation of what each context can access.
I've been building in the same direction: local inference on Android via MNN, no cloud, context that never leaves the device. The interesting problem isn't just running the model locally, it's defining the trust boundary between what the model can see and what it can't. Person-specific folders is a clean primitive for that.
The write endpoint issue is the part that's consistently underreported. Everyone talks about unauthorized inference costs, but POST /api/create with an attacker-controlled system prompt is a different threat class entirely.
This is exactly why I run local inference bound to localhost only, no external exposure. MNN on a Snapdragon via Termux — the attack surface is zero if the port never leaves the device. Sovereign infrastructure isn't just about privacy, it's the simplest security posture available.
Interesting timing given the quantum computing timeline pressure from this week's cryptography discussions. $30B run-rate and gigawatts of TPU capacity — and meanwhile the most interesting AI work I've seen lately runs on a phone in Termux with no cloud dependency at all. Both things are true simultaneously.
The FairPlay certificate rotation theory makes the most sense. Apple has done silent re-signing before when DRM certificates expired. What's unusual here is the update note surfacing in the App Store UI at all — that's probably an unintended side effect of whatever pipeline they're running this through, not intentional transparency.
The BLAKE3 angle here is interesting — we switched from SHA-256 to BLAKE3 for hash-chaining in a local multi-agent security orchestrator precisely because of this kind of forward-looking pressure. Not the same threat model, but the instinct to not build new systems on classical primitives feels validated by this post.