The hard part isn't the crypto or the sandboxing, it's enforcement and incentives

The hard part _includes_ the crypto and the sandboxing. Short of playing security theater games like "chuck it in a TEE", the moment your data needs any kind of processing, or possesses relationships with other users data (or their ability to view your data, like a social media feed), the complexity increases exponentially.