It turns out all you need to deploy an encrypted mempool (via Batched Threshold Encryption) is an off-the shelf DKG. No CRS required.
Ciphertext overhead is 2G1 + G2 + 2F and partial decryptions are a single G1 element. Decryption runs in O(B log^2 B) time.