Short: fwupd users download small but in total too much metadata over the internet. This is a beginning of something important, and the tech can be used for local updates and a lot more.
A solution for local distribution is needed. IPFS is too slow, Bittorrent is immediately suspicious on many Networks.
Passim is a new protocol for this purpose, users can opt out, it is secure and the metadata is hashed, and the hashes still downloaded over the internet for verification.
Number 2 is exactly where my hesitancy lies. Is a CDN still chugging along - not serving stuff to a select user group that has passim enabled is actually finding the fw - saving enough energy for it to cancel out a whole p2p network. I don’t think so (and again, I’d need some metrics before I will. you can’t just waive that away with 'local == fast&less steps == obvious; don’t need statistics)
As for number 3: p2p can only say if there are peers. if there are no peers, there still can be an update (what about the first person to download the firmware for example). It would be a security risk for the system to not give you updates if there are no peers, so I highly doubt that’s the case.
To 3 I suppose one would disable p2p download and only enable seeding/sending the stuff