> users must trust relays to propagate and preserve content

Given the low exit costs I don't think this characterization is correct. If you find a relay is not propagating or preserving your content you can simply drop it - you don't have to trust relays. Or maybe it's better described as a "trust but verify" model. 🤔

Thanks for sharing this and your concise comparison document. It reminded me to finish a script I've been working on to keep a local backup of all events from my npubs (e.g. to run on a homelab or whatever):