Item #8 needed more information as well. I had tried to use the "exportAsXFDF()" in a trusted function and it would never work in Reader. It has an "F" in the availability column of the "Quick Bar" in the JavaScript API Reference which means it requires "forms rights". I saw that; but it was not clear to me if that meant that a trusted function would work. So, it looks like trusted functions will not get around security settings if forms rights are required.
The documentation is very vague on this issue, unfortunately. "Form rights" sounds like the general right that you can apply in Acrobat for filling-in form fields. It's not. It's a special right that needs to be applied using a LiveCycle server product (LiveCycle Reader Extensions, if I remember correctly), which is very (very) expensive. It has nothing to do with the function being trusted or not.