I have a few thoughts about privacy for you.

Don't use academia.edu or researchgate. It's a big story waiting to get out. There's absolutely no privacy on these sites and they track everything. I get an email notification from these sites every time someone does a search query that happens to display my paper as a result. I also get notified when someone has been reading a paper through their platform. The privacy implications are really gross. I hope that they delete this data, stop collecting it, and that nobody ever gets a copy of that.

Academic PDFs downloaded from academic publishers include deanonymizing information such as your name, your institutional affiliation, IP address, and sometimes your email address. I wrote a tool to help remove this information from pdfs: https://github.com/kanzure/pdfparanoia

As for scihub, many of your concerns can be mitigated by having an offline copy. There are torrents published by scihub (or libgen's scimag, which is supposedly a mirror of scihub?). I have had a lot of trouble getting a relatively complete copy due to low seeder bandwidth and lack of seeders. There's a forum somewhere that you can request libgen users to seed certain torrents, your mileage will vary.

I think every academic library should have a complete copy of scihub. Keep in mind, scihub isn't just using library ezproxy accounts, she also has a large cache of files. Supposedly that's 70 million papers at the moment. It's about ~50 terabytes or something.

My recommendation is that scihub should be running pdfparanoia on all of their papers. It only removes visible watermarks. I haven't investigated invisible watermarks yet. I'm definitely interested in those.

Turning up the paranoia dial a little more, I am concerned that scihub may have a deal with a nation state actor for the purposes of phoning home about research article downloads from certain countries, in exchange for allowing scihub to continue to operate. Going further, this could include pdf malware (or metadata tainting for fingerprinting) or browser exploits. This level of international espionage would be very useful to a nation, and might explain any nation's interest in keeping scihub operational despite political or civil court pressures. Of course, it's also helpful that scihub is running in an area of the world that doesn't really care about demands from U.S. courts, so none of this is necessary to explain the continued existence of scihub.

Ever since I began thinking about the deanonymizing data inserted into pdfs by academic publishers, I've been wondering about collaboration between academic publishers and nation state entities. This is a concern even in absence of scihub existing. Also, many of these publishers have really bad web security and it's trivial to take data like apache logs or whatever, because they are publishers not software experts especially the smaller publishers. Who else is taking that data, and what can they do with it?

Academic privacy is extremely important for the freedom of science and human progress, and I haven't figured out how to juggle those priorities against the priority of making complete mirrors of scihub. I am deeply worried about that data trove disappearing. It's one of our most important data sets...