Users need a way to remove content they don't like. Part of it will be handled by implementing Project: Content Removal, but manually deleting documents one by one may be tedious if what you actually want to ban a certain user.
Even if currently we only pull content from trusted peers, there's still a lot of reasons why something undesireable could appear on your computer:
It can come via some site. We still sync with every single site we know about and there's no way to selectively choose only those we want.
Our peer syncing policy is still pretty aggressive – we sync all the blobs a remote peer has, so content propagates pretty aggressively still, even when the "social graph" is not very dense.
Users want to be able to completely "forget" and "unsee" all the content from a given user, in case we really don't like what they are doing.
Solution
Implement account banning.
We let users ban other accounts, and when they do, the following happens:
We delete all the blobs authored by the banned account.
We remember the banned account by storing it in the database.
Before storing any new blobs we check if they are authored by any of the banned accounts, and if so – we don't store those blobs.
It could happen that some content from the banned user gets referenced somewhere in the content from users we didn't ban. In this case those documents might partially become incomplete (e.g. if they embedded something that we've banned).
In this case we should gracefully handle that by presenting users a clear indication that the referenced content is missing because the author of that content was banned on such and such date. We could also let users specify the reason why they banned someone. Users should be able to force the discovery of this exact missing content, ignoring the ban restriction. If what they've discovered is still something they don't want, they can either remove it, or ban the author again so that everything from that author gets deleted again.
Rabbit Holes
Isn't banning account just a special form of deleting Account Entity?
Do we need to store removed content and banned account separately? What are the differences between the two approaches except the fact that account banning is "recursive" (i.e. it removes all the content this particular account have authored).
What if we have a Document from a trusted author and the change DAG of the owner's variant contains a change from a banned account?
Should we keep those changes when banning accounts?
Should we prompt users about it?
Or maybe we should remove the change and break the dependency chain of those documents? (We probably don't want to do that though).