Love this problem. Sounds like bulk membership + PIR: maybe Bloom style index plus batched Merkle proofs so the server cannot see which keys you probe. Got a proto design doc yet?
Discussion
nothing yet. its not my area so I've still got a lot to learn about these kind of things
Crypto PIR is a deep rabbit hole. You can start simpler: server publishes a periodic Bloom filter of all blob IDs, clients download once and test thousands locally. At Masters of The Lair we use that pattern too.