explain how it requires trust? my understanding is that masternodes are randomly selected, there is no way of knowhing which nodes will be selected, so an attacker has an unrealistic chance of owning the correct nodes required to intercept the transaction lock...
You have to trust the honesty of the MasterNodes that vote, that's what I mean when I speak about a system designed from an assumed-trust instead of an assumed-malice perspective. The other avenue here is an attacker can disrupt every single InstantX attempt by serving up modified (but still valid) transactions for every InstantX transaction they observe, which will make those InstantX transactions fall back to normal verification.
That's why jgarzik (Bitcoin Core Dev)
wrote this fantastic post: "
The process of consensus "settles" upon a timeline of transactions, and this process -- by design -- is necessarily far from instant. Alt-coins that madly attempt 10-second block times etc. are simply a vain attempt to paper over this fundamental design attribute: consensus takes time."
The solution to this is not a centralised and trusted voting network, it's to use off-chain or side-chain transactions for rapidity, and regularly settle back to the mainchain.
i understand your point but I don't think it's as clear cut as you make out. Bitcoin has problems with mining share undermining it's trustless nature which pose a far greater threat than Evan's ability to roll back new features. The control he has is for the security of the coin and investors realise that even though opponents, such as yourself, try to make out otherwise.
Perhaps a closer analogy than mining pools is the fact that the Bitcoin github project has a handful of collaborators, and they are all able to surreptitiously merge malicious code. The problem is that this is visible, and other will raise the red flag, whereas the spork key can be used to muck with the network with nobody knowing.
It's not so much "do you trust Evan", but more "do you trust that his opsec is so tight that no attacker, no matter how motivated and powerful, will ever gain access to the key to abuse it?" I don't even trust myself to secure my own computer, and I can assure you I have a significantly higher level of paranoia and tech-savvyness than most. The solution is not to layer complexity by splitting the key up over multiple locations (they have to come together anyway to be used), the solution is to discard a dangerous and broken mechanism.