@SoapDog: only include feeds which have been cleared for ssb-viewer display as those people have already vouched that they are ok with being publically viewed.
If we do like that, then it would be impossible for Alice to get Bob's feed through the zip file, if Bob has chosen publicHosting=off, even if Alice is friends with Bob. So I think we need to skip the publicHosting verification.
I would actually simplify even further by packing a specific feed for each zip. This way we explicitly acknowledge who's data are we exporting, but also it's an easy way of starting to write this code.