thinking about it, no one is really going to run their own homeserver, so they will be essentially delegating full power over their identity to some vibecoded malicious provider "but they just change their pkarr and retract everything" then in this world nothing anyone ever says can be trusted to really come from them