This royalty-free standard format [[https://developers.facebook.com/blog/post/2018/02/20/3d-posts-facebook/ | was enabled today on Facebook]], which means it's likely to take off a bit (and can be exported from Blender).
The format is described at https://www.khronos.org/gltf/ supports textures and animations (which STL doesn't) and is designed to be efficient for transmission and client-side interpretation, which would work nicely for us.
Obviously this'd be a fair bit of work, not least the security concerns. Would be interesting to see what Facebook have done in this regard, and whether we could reuse their work if it's FLOSS.
It looks like most of what we need is in three.js, which we already use for the stl rendering, so rough plan for using the .glb binary variant would be:
[ ] add .glb and proper mime type to core's mime.info
[ ] add a validation hook for uploaded files to 3D (magic number, proper sections, valid json, no external uri references)
[ ] include three.js's gltf loader in 3D and 3d2png's js modules
[ ] change thumbor config to pass glb through the 3d2png handler
[ ] add mmv plugin config for glb as well as stl
[ ] change varnish config to gzip the glb files on transfer