Aye, my proposal was a trade off between privacy and convenience for non technical users ( it's only as bad as a non federated social media site).
The best balance here would be a client on the user device that manages the keys for you, and an API in lemmy for accepting and sending encrypted messages.
As a side note, I thing PGP is more or less superseded by AGE
On encrypting messages, this is a solved e2e problem if users home instances generate public private key pairs for its users on sign-up ( or users can provide their own )
Tbh it would be trivial to just salt and hash the usernames (for keying the votes), no need to encrypt or involve the users password. The salting and hashing would be handled by the users home instance ( which presumably the user trusts ) so building a rainbow table would be non trivial for an attacker ( assuming the home instance keeps its salts secret ).
All very true, basically the same deal as with any 90/early 00's forum.
I feel like there is a higher barrier to entry for lemmy, it needs to be lower friction in the sign-up process, people don't want to have to work out what instance they should sing up to to make an account!
I love these type of articles, great for refugees like me! Thanks for demystifying!