[KirinDave]

The bloom filter wouldn't stop you from confirming folks gathered around any specific page that has content, and would have a fixed probability of leaking data even if there was no data there.

And that ignores the problem that you're not going to be able to sync the bloom filter in real time, so now you're going to need to have a very merge-friendly design for these annotations.

No, I'm not being pessimistic. This is just a candid analysis of the difficulties of doing this competently. If you'd like to do it incompetently, feel free.