Matthew,
One issue I think needs to be added is making the package not a singleton.
Each subsite should be able to mount their own instance. And, Ideally each user could have their own contacts app online. A public/private/whatever permission could be granted with one of those defaulted by subsite.
