The second is federation like email. Everyone has the option to become a provider or trust an existing provider. Of course the problem is that you need to trust your provider and the providers have to trust other providers. Spammers can just set up their own provider to attack other providers, so providers need the ability to block providers they disagree with. Providers don't live forever or they can become untrustworthy, there needs to be a way to export the data and import it into a new provider. You will need digitally sign all your data to prove that it came from you. There also needs to be a mechanism to confirm that user10@oldprovider is the same user as user5@newprovider and redirect from the old identifier to the new one.
The third is the least likely. A full P2P architecture where every peer is equal. Every peer will be forced to store the entire database of the application and run all computation locally. Spam will be an even bigger problem than with federation because you will have to store the spam for eternity too. The dataset will eventually become large enough that a single computer cannot store it.
I'm betting on federation. It's the middle ground between full centralisation and full decentralisation.
I for one am sick of trusting corps only because they can implement software that protects their own servers. We can't be held hostages by spam forever.
(I would even wager spam is partially funded by corps so as to scare the users back to their walled gardens but that's uncertain and not especially likely.)
Unless the governments outlaw encrypted communications and/or homemade wireless equipment, it's never too late.
We've left the corporations run wild for far too long. They've been stupid, slow and it took them A LONG TIME to catch up. And eventually they did. All the while all of us did absolutely nothing. At least myself.
^ All of that is an idealistic revolutionist talk, I am aware. Had I had the free time and reserve capital however, I'd be dead-serious about starting such an effort.