Right – this is why I think the solution isn’t a local possibly-too-curious nerd, but rather a "Wave Federation" of official Diaspora servers and other third parties, possibly charging a small monthly fee. Maybe (almost certainly not, but maybe) some ISPs would provide such a service as part of their bundle.

The other solution is for the "local nerd's" set-up to never view unencrypted data. If you watch the Diaspora* intro video, they are talking about having encrypted content available for each friend… if this encrypted content were uploaded to the local nerd’s server, that solves the untrusted admin problem.