Speaking as one of the people interested in running one of those big behind-the-firewall Supermarket instances, I definitely have a lot of these concerns in mind.
Ideally, I'd like for my Supermarket to proxy queries to the community one, which means namespacing would be a big problem for me right up front. Without namespacing (in the cookbook name or as some kind of user/org prefix), distinguishing between BigCo's "java" cookbook and the community's "java" cookbook would be an issue.
We do also have the problem of orphaned cookbooks (and GitHub Enterprise repositories, for that matter) as people leave the company or their role/workload changes. An opt-in or default policy of who takes responsibility for a cookbook once the original owner goes inactive (as determined by Curry noticing stale issues, maybe?) would be pretty cool. Particularly because I think we'd like to distinguish between central-team-supported cookbooks, satellite-team-supported cookbooks and individually-shared cookbooks. Each of those is likely to have a different level of support and it seems like shoppers should be able to easily distinguish between them while browsing cookbooks.
None of these is a deal breaker for me to run Supermarket but I'm happy to participate in community efforts to figure out and test possible solutions/implementations.