[Zope] Product architecture question (long)

[Nikko Wolf]

I've been using Zope (w/Plone) for some time now and am still trying to
understand how best to architect the solution for my site.

I'm presuming I need to create a Product for the new types of
objects/files I want, but even on that topic I'm not completely convinced.

My objectives and constraints are:

- The primary purpose for the site's existence is to manage some
   content files (text/ml) and allow a workflow process on those.
   The workflow will likely change and hopefully will have minimal
   programming changes when it does.

- Users will have one of several roles: Author, Reviewer (of
   which there are currently two types), and Editor.

- I do not want ANY access by unauthorized users. Obviously they
   must be able to reach a login page, and get instructions on how
   to request an account, password reset, etc.

- Here's the complication -- each file will have potentially
   multiple versions in process at once.  Each version of a file
   may have a different state, and I'd like to have a history of
   all changes to each version as they go through the workflow.

- Once a file/version is submitted for review, any of the reviewers
   may work on it, it is not necessary that one role preceded the other,
   but it is required that a user in each role approve the file.

- The workflow is subject to change (the real one that the humans
   use), so this could precipitate changes to the Zope workflow:

   - The users' roles may change (easy),
   - There might be another type of Reviewer created that gets
     grafted into the review process,
   - There might be other steps ("states") added to the workflow,
     and corresponding changes to the process.

- We need to have good automated backup solution for the content
   (as in mirroring the content on another host).

- And, of course, I'm under pretty extreme time pressure.

===============
So my questions are:
0) Is DCWorkflow and a new Product [document type(s)] the way to go?
1) Is there a product that does something similar that I could use
    or adapt?
2) Barring that, is there a product that would be a good starting
    point?
3) Is there something that manages a file history (like CVS, etc.)
    that can be easily used within Zope?
4) How does one secure a Zope+Plone site?

I'm running on FC3, Zope 2.7.6-final, Plone 2.0.5, Python 2.3.4

Thanks in advance!
Nikko