> delegating full power over their identity to some vibecoded malicious provider If the homeserver controlled your identity, homeserver migrations would not be possible. Homeserver migrations are possible even after a homeserver has “banned” you. So I think there is some gaps in your understanding