KeepassXC is encrypted locally with no public servers :)

Are there really people out there not using a password manager in current year?

Doubly so on federated platforms, though. Your ability to delete your posts, toots, and even DMs is at the mercy of other servers deciding to respect delete requests or ignore them. Not to mention completely invisible non-public nodes that are probably definitely as we speak hoovering up all data.

A single “entire” instance being ruined is a much smaller problem than a whole platform.

As for the duplicate community problem, I would love to see either a multi-reddit-like feature or the ability to merge/co-mingle “duplicate” communities across instances.

The solution to tyrannical mods or admins is simple: “take your ball and go home” by starting your own instance, or your own community on a separate instance. That said, instances and communities grow by growing trust between users and mods/admins by a track record of acting in a rational and trustworthy way.

Privacy is definitely a problem for Lemmy. You should assume everything you post or comment is public and in the open, and impossible to fully delete, because it is. Post accordingly. You could theoretically be identified by the sum total of all personally identifying information you freely post over a long enough time or by your writing style if a government considered you a real threat.

That said, many instances do not even require an email address. I don’t know whether instances store data like IP addresses, but you could check the lemmy source code to find out.

Edit: But also, who’s to say their server source code is unaltered? Federation lives and dies by trust and mutual cooperation, and that cannot be guaranteed.

Basically, it makes the whole platform less secure because you could accidentally send a non-encrypted message at any time. With SMS-free Signal, at least mistaken sent messages are still E2E encrypted.

Is their goal to become the new de-facto messaging app? Or is their goal to become the most secure messaging app for whistle blowers, etc for whom a single mistake could mean losing their life or their freedom?

That’s a little reductive… Lemmy Admins are users as well. And any bug reports or feedback you provide is implemented to improve Lemmy, which we all benefit from.