> It's hard to convert this to technical requirement -- this is largely a moral requirement on someone running the service. That's the second best option -- first would be this being technicall not possible.

It's hard to imagine this idea getting traction, but one way to implement this would be to require new features to be approved by (say) a majority of active users. This could act as a brake on roll-out of creepy features (if people read before approving …), but it might also slow or retard genuine advancements (although "no to constant interface re-design" is a feature in my book).