> One adjustment to the protocol that seems to me like a quick win (but presumably has some technical hitch I can't see, since I don't recall anyone suggesting this) would be to not include the post's body in the “block” (in the message itself that gets hashed and signed by the next message), but rather as a “blob” (essentially an attachment) which others don't need to download in order to verify the feed.

There's nothing to prevent you from taking this route, you just sign a blob hash instead of an entire message object.

I work on an experimental SSB-like-protocol in my spare time that does exactly what you've suggested: https://github.com/evbogue/bogbook

I don't know if this makes the network forget more, but the aim is to reduce the time it takes to sync and get started.