This is neat, but I think the "easiest", read most user friendly, option would be to separate things out between phone and 3DS app + Luma3DS patch for background transfers, and all the communication is handled over internet via centralized server.
Basically the main app is on the 3DS, it should allow you to create a simple profile on the central server that holds all the relevant street pass information. Either via a manually created profile, or an automatically created one based on whatever unique information is on the 3DS. Other functions would only need to be something like a one button upload of new street pass data and manual download for convenience. This app could also keep track of all street pass data, and whether it came from the 3DS itself or was downloaded from the server instead.
The Luma3DS patch, if possible, would basically just upload and download new things through the app in the background, either on boot, once per hour, or something like that.
Meanwhile the phone app would basically just be the companion app, download it, scan a custom QR code on the 3DS to sync it to the same profile on the server, and then listen for other people running the same app. If there's a hit either phone transmits that hit to the server, the server "exchanges" the data internally, and both people can then download the new street pass data the next time they boot their 3DS near a wifi location.
While this approach would still be incredibly complex, it should skip a bunch of stupid translation, conversion, and privacy issues since most of the sensitive bits are entirely contained within the central server. It would also make it fairly easy to set up an account as most of that could be automated, especially on the phone.
It should also help deal with security concerns over bluetooth, as basically nothing but a short ID would need to be transmitted, which should be simple to sanitize so it can't be used to run arbitrary code on either phone. Similar for the server handling everything, the only streetpass data would come from 3DS systems, the phones would only ever upload an ID, a time stamp, and probably not much else.
Edit: Maybe this is something the pretendo devs could help with, too. If you could piggy back off of their auth system and infrastructure that might streamline a thing or two.
@
AncientBoi:
@
BakerMan:
it! 
..............................