Hiding profile fields but exposing them on a per user basis - possible?

I will shortly be creating a 'handshake' module. The idea is that all user data (except username and possibly one or two other items as determined by the site admin) is hidden from all other users. Only the user whose data it is and the site's authorized user administrators can view it. Users will be able to initiate a 'handshake' where the first user indicates (probably via checkbox) which data fields s/he is willing to expose. The second user gets a list of data field titles that are checked (only those checked by user one show up). S/he then decides to either leave them checked or to uncheck those fields s/he isn't willing to share. User two then accepts, or rejects the handshake. If rejected, user one is notified. A reason may or may not be given by user two. If accepted, the agreed-to data field list items are then exposed to both users and each user is added to the other's contacts list - a separate module similar to buddylists. I will have to keep track of profile fields for each user and who is authorized to see each one. I will then have to make sure that whenever the data is requested, and on any page or view, that only authorized fields are shown to the user requesting them.

So what I need to decide before I can get started on this is what to use for profiles. Do I want to use nodeprofiles? Bio? Regular profiles? My own from scratch? With the overhead that will likely be required to have such granular access control over the fields, do I want to deal with the overhead from nodes as well? Do I need the search capability of nodes? If so, any search results have to be filtered. How hard will that be using existing search functions? I certainly don't need comments. It would be nice to use CCK. Could I roll my own CCK-enabled profile module without the overhead of the other features that nodes have? Is anyone working on that already? What else am I not considering? Is there anything out there that can already do all of this?

I guess in addition to the 'handshake' module, I'm also implying the need for an access module. If I use nodes as profiles, then it would be per-user-node-field-access, or something. If I roll my own profile or extend the existing profile module, then it would be per-user-profile-field-access. I wonder if one would be easier than the other and should be a factor in my decision of which route to take. I know that node-access modules are common. Are sub-node (in my case fields) access modules something that is common as well?

So I'm just interested in what all of your opinions are on this matter. At this point in time, I'm leaning toward investigating the idea of a custom cck-enabled profile module.

BTW, I heard some time back that there was talk about super-nodes; making a generic container for regular nodes, profiles, comments and whatever else that would share a certain amount of minimal features but not be as heavy as regular nodes. This would make profiles searchable, but without the overhead of nodes, for example. It could also cck-enable anything under the sun like comments of profiles. Has anyone heard if this will ever be a reality, like maybe in Drupal 6?