I don't know, if I should comment on the proposual or stay with 'perl 101'. So, please remember: Everything in my comment that is or look wrong is a hard reference to my misconception of the mechanics of PM.

Restrict the viewing of edits to nodes, to those that can actually view those nodes (canReadNode).

This is pretty obvious to me. If I can't view some information, I don't know about the change history of said information.

Add a flag for the editors to set, if a particular edit is sensitive (eg removing email/passwords).

Since I didn't understand the details of an "edits to nodes"-cycle, I can't say much about the necessarity of said flag. Of course, removing sensitive information is important, but what is the benefit of flaging sensitive edits as sensitive?

Remove the 'history' link from the editors nodelet, and add it to the approval and node status nodelets

I buy that one. The change history of a node -- and that's the way, I look on "edits to nodes" -- is part of the nodes metainformation, not of editors metainformation.

Create a new superdoc for editors, to view all recent edits made (...)
Link to the new doc from the editors nodelet.

I don't know, what a "superdoc" is, but I imagine a kind of "svn status --show-updates --verbose" or something similar. If that image is somewhere in the proximity of a "superdoc", it's quite reasonable to provide the complete list of changes between the "HEAD" and the "PREV" revision. And of course, there had to be a link for the benefit of those, who edit.

I hope, I'm somewhere within epsilon ;-)