instead of making the raw crash a branch of the processed crash, could you consider making a two branch tree instead? 

    raw_and_precessed = {
        'raw_crash': raw_crash,
        'processed_crash': processed_crash
    }

or would that be too disruptive to all the data that's already in ES?

One of my current initiatives is to unify the fragmentation of the processed_crash format.  The current state is that PG, ES, and HB/FS all store the processed crash in a little bit different form.  PG/HB/FS are all lossy - the new redaction methods and the saving the json form of the processed crash in PG are all about making them all store exactly the same data.

If you add the 'raw_crash' key to the processed crash, you're making the ES processed crash different from the others.  When we eventually document the processed_crash schema, we'll have to make an exception for ES and point out the difference.