Why shouldn't it follow the user's email display setting? Or maybe only a subset, eg "if public, display and allow search for everyone - if not public, limit to people with suitable privs" {the restriction being in case Alice trusts Bob to see her email address, but not Carol - if Bob doesn't know that, and esp. if he's used to the way LJ does things, he may let it slip)