I guess in principal, this is Bluesky "The company" asking, not BlueSky the protocol...

understanding how the AT protocol works, in reality it is not very decentralized, because as I understand it, the essential keys to access one's account are held by the bluesky company, so although one can set up their own servers, they still have your account.

Indeed, the load is decentralized, the management is not. You're free to provide Bluesky with load balancing bandwidth for free, basically.

My first thought was hash the birthday and add salt, but that only works with a centralized server, which bluesky appears to be anyway.

Bluesky is federated much like mastodon. If your relay doesn't talk to your friend's relay, you won't see them.

Yeah that sucks. I ran Mastodon for a while, but didn't use it because of this.