Not the original poster but I do have some ideas. Official Bluesky clients could randomly/round-robin access 3-4 different appview servers run by different organizations instead of one centralized server. Likewise there could be 3-4 relays instead of one. Upgrades could roll across the servers so they don't all get hit by bugs immediately.

If multiple personal data servers (pdses) share the same set of posts how would we guarantee that they are tamper resistant to third parties?

PDSes should be sharded not replicated. Your posts live on your PDS which lives in one place (although it can move).

What's stopping us from doing both?

Cost and complexity tradeoffs. IMO the relay/appview is the current bottleneck.

This is why I'm hoping fiatjaf has a recommendation here. I have a feeling he might have a proposal that solves this. But doesn't solve all of it, just some of it.