Not to shoot the messenger or something like that :)
With regard to the DL mofidication issue, why would it not be possible to put some intelligence into DSProxy and have it directly detect the domain of the DL and have it refer the client to the appropriate DC (in whatever site) for the intended modification? If it's able to detect the client's domain right now, then it should be able to detect (from the change requested by the client) that the DL is NOT in the same domain as the client and the change can not be executed on the client's DC. It should then say something to the effect "this change can only happen on DC-xyz, go there".
Considering that the DL mod piece that is not addressed here is arguably the most sought-after feature (well....maybe "second-most-sought-after" - after delegation), I'd think that, given the huge efforts you guys put into making SP2, you'd at least put something (even if not elegant) in there to ameliorate the pains people are experiencing right now in a multi-domain environment.
Or did you, and I'm just over-simplifying the solution?
All in all, nice write-up. And good work on the enhancements.