It's unclear (regardless of crypto shredding) what the delete policy should be if the data involves multiple people.

Why would it? Typically you would have one stream per user.

Event: "User A sent Message X to User B". (I think the answer here is again to have PII be in other repositories, and only refer to them by id in the log.)

Good question. Create alias proxies?