This looks very well thought out -- I'm really impressed by the effort you've put into this so far! Taking the time to draw pictures is always appreciated. :)

I think that the best way to handle these security questions would be an option at the time of creating the calendar -- I like what Google Docs does, where you can have a public document or an invite-only document. Maybe we could make it so that calendars were public (and listed, linked off the profile, like right next to tags and memories), access-locked (listed linked off the profile, visible to all people on your access list), custom group locked (listed linked off the profile, visible to all people in a custom group), or invite-only (not listed linked off the profile, viewable only through the invite link until you become a 'member' of that calendar) -- making invites essentially an access group without having to form an actual access group.

I particularly like your attitude on options. There's a careful balance between making something have enough options to be useful, and making something have too many options and be confusing!

And yes, we would absolutely post an entry asking people what they would want to see in a system like this. Our users are very, very good at giving their opinions. :)