There is no such thing as a "bitcoin privacy model".
There absolutely is,
http://bitcoin.org/bitcoin.pdf Section 10.
The green address system is opt-in.
Only partially. The sender can opt-in. The receiver gets it if sender chose, if they like it or not. Further downstream users— who's identity is now more disclosed by association with a named entity in the block-chain— don't really get a say at all. The hundreds of thousands of other uninterested nodes will waste cpu cycles validating these signatures (and the pointless transactions required to create the inputs) and storage recording them, even those these transactions do not serve to further their interests in the way that general blockchain validation does. They could, of course, filter out the ones that they're aware of, but unless they all do it they'll be forced to validate them when they are mined or risk their security.
There are many sources of cost here and most of them are externalized.
They also encourage poor key management practices (e.g. constantly assigning funds to a long term online key which is potentially subject to theft),
That somewhat goes with the "instant transfer" feature, I don't think you can really have this without leaving some key online at some point. You could still mitigate that risk by using a multiple signature address as marker address.
It doesn't. A transaction requires only the keys being online that sign for the particular input coins. Prudent key management would have those keys used only once. A marker address is a long term key. In-band marker address usage requires constantly assigning funds do a long term key. It's a bad practice and increases the exposure to theft, if only marginally.
"conveying information that is only interesting to a single pair of parties" is pretty much what Bitcoin already does. At the end of the day it's the market that will decide what's a fair price for this additional bit of information. It seems logical that instant transactions between green-address aware parties might cost a little more.
Bitcoin has gone to rather extraordinary lengths to avoid including any more data than strictly necessary in the globally and eternally visible flooded blockchain. The only data included is the minimum required to have the system be fully decentralized, secure, and inflation proof. This information is in the interest of all bitcoin users: we want to protect you from double spends because we want to prevent inflation in order to make Bitcoin useful. If it were believed to be viable to include a memo field in transactions there would be one; it isn't like the usefulness of them is a surprise (the old IP transactions had a memo field, in fact, but they never showed up in the public network.)
There is no mechanism available to directly compensate most of the parties that undertake the costs created by a third party's use of in-band marker addresses.
You just need blockexplorer or a similar tool to validate a green address transfer which is much simpler than validating a detached signature.
There is no reason that other schemes can't be made just as easy— or even easier, since they have a chance of being integrated. Validating a detached signature using blockexplorer could be as simple as following a link. E.g. With a simple bit of JS,
http://blockexplorer.com/tx/eb620fe4cdc24afbd2ded229577c64fbb099a39e80bcc15750b84c04b7878d90#G7mlJ2Db1W68LQPkqNt0UAyEE9xNI4KVMxy/GSwI/TU8GH2rUzs7jKFr9yq6M43zsKUHlqIF9HQ1pypvWpuUg8E= could display "This transaction is certified against reversal by 1GMaxweLLbo8mdXvnnC19Wt2wigiYUKgEB"
Of course, as Pieter points out— payment protocols are even more powerful. There are a lot of superior options.
My concern is that things like inband-marker addresses discourage the implementation of better solutions which have fewer compromises simply because it has a lower startup cost. As a community we need to resist that kind of lazyness if we're to keep our system healthy.
Edit: With some code from Joric, I setup exactly
the validation I described above. The signature checking is all client side, so the normal operaiton of the site doesn't even cause them to learn the relevant marker addresses being checked unless they go out of their way to inject monitoring code.
