Well look at that. I didn’t know this attack was already formalized. 
I discussed this attack (or something very similar) with David about two weeks ago. As David said, the endpoints are the weakness.
See:
For Uploads:
POTENTIAL SOLUTION
The idea is to have the Client ask the Close Group for the Data Managers public key. The Client then self encrypts the chunks first with the Data Managers’ public key, second with the Close Group public key, and finally with the Clients public key. During transport to the Vaults, each layer is peeled off like an onion by the respective Groups/Managers. Problem solved. I hope.
For Downloads:
POTENTIAL SOLUTION
The Data Managers salt the chunks, encrypts the chunks with the Clients’ (the requester) public key, then finally encrypts each chunk with the Close Groups’ public key. The first layer is peeled off by the close group, the second is decrypted by the Client before finally discarding the salt and joining the chunks together to reconstruct the complete file. Solved?
@dirvine We’ve discussed this before but I’m still unclear if this is confirmed to be both possible and planned for version 1.0 of the network. Maybe as an optional feature?