That's up to you, but I prefer to use both. The 301 redirect, once set up, should always work. At times a site experiences an issue whereby a .htaccess file is deleted, overwritten or modified accidentally. When that happens the issue may not be immediately discovered. Lots of headaches can be caused this way.

The canonical tag helps minimize the damage in this case, and also helps with the natural variations websites have such as a "print" version of a page.

In my experience a 301 redirect is always the superior course of action. One reason is with a 301 redirect, you will ensure those who create links to your site will use the proper URL format. This way, your links go directly to the proper page without losing any link juice to a redirect.

Canonical tags are a great backup in case something goes wrong, but 301 redirects are always preferable.

I would suggest you take a look at this page on MozTrust. As the name indicates,  MozTrust is an tool which measures trust factors for a website.

MozTrust and PR are similar metrics. They are both attempts to determine a site's importance and credibility. The largest factor is your site's ability to earn credible external links from other credible sites.

Example 1- you create a natural viagra-like sex supplement using common ingredients from other similar pills. You set up an e-commerce site and sell your product. It will likely take you a long time (i.e. years) to build up trust unless you pour an enormous amount of resources (i.e. money) into the site.

Example 2 - you create a natural viagra-like sex supplement based on credible research from UC Berkeley or another credible institution. You perform authentic studies by doctors and the results are published in the New England Journal of Medicine and other credible medical journals. The doctors and researchers involved in the study all post numerous articles on your site, and respond to questions.

As a result of the above activities, the New York Times, CNN and other credible news sources cover the story and link to your site. Additionally the doctors involved with the study are asked to be interviewed on Oprah and other television shows. All the media hype turns into hundreds of links from highly credibly sites and a lot of social media buzz.

The second example can help a brand new site very quickly earn a lot of trust. Then the product begins selling, authentic testimonials are received, further research is performed, more doctors and patients begin working with the product, leading to even more credibility and trust.

The best resource for XML sitemap information is http://www.sitemaps.org/protocol.php

The order makes no difference at all. If you have proper site navigation, the sitemap really does not perform any function. A search engine will scan the sitemap and determine if it has any URLs which have not been crawled, then decide upon what action to take. The URLs already in their database are disregarded unless they have new information (i.e. the last mod date is newer then when the page was last crawled).

How long is the period for google to trust a completely new URL?

Trust is earned over time with links. Some sites will gain it very quickly, while others will never achieve high levels of trust.

The first question is, how exactly do you define "trust"? You could use PR to measure trust, but everything is relative. If you only consider a PR 10 site as trustworthy, it is 99.99% likely that your site will never be trustworthy. As of Aug 4th, 2011 there are only 14 PR 10 websites (pages) worldwide, yet there are tens of millions of websites.

Even if you establish a certain level as trustworthy, such as PR 7, the next issue is measuring PR. Google only releases PR toolbar updates 3-4 times each year, but the figures are updated daily internally.

If you decided PR 7 was your goal (as an example) then it is possible to achieve a PR 7 site quickly if you could pump enough resources (i.e. money) into the site. If you created a well-designed, quality site which offered a product, service or information that was credible enough to cause enough interest, then it can certainly be done.

do you think it is more important for a site to get say, 20 backlinks from anywhere. Or 5 backlinks from very trusted blogs, etc.?

I would prefer 1 quality link in content from a trusted blog or other quality source then 100 "backlinks from anywhere".

I am not clear on your question.

It sounds like your site was hacked and new web pages were added to your site. You discovered the problem and removed the added pages, thereby removing the links they created.

When you ask "Can you block backlinks from another domain", who owns the domain which have the web pages with the links? When you ask to "block" the links, block how? from whom?

My best guess is you are worried about being hacked again by the same group. It sounds like you have blocked the /data folder in robots.txt so if the same group hacked your site in the same way, the pages would not be seen or crawled by Google nor Bing since you have it blocked. If they used a new directory, that solution would not work. The best approach is to upgrade your site's security and have it tested. Change all passwords, etc.

HTML sitemaps are generally designed for users, where XML sitemaps are designed for search engines. While either party could use either form of sitemap, each format is optimized for their intended audience.

If your site has proper navigation set up, a sitemap has almost no value at all. The modern day value of a sitemap submission to search engines is to alert search engines to web pages they would not otherwise locate during a crawl.

250 products seems like a lot to present on a page for an average user. Many product pages offer numerous links for each product for image viewing, examining the main product page, options such as colors, etc. A page with 250+ products seems unfriendly to most users and search engines, as I imagine the page may have 500+ links.