If their support of cryptobro social network Nostr wasn’t a huge red flag, Mullenweg’s stamp of approval surely is

No ActivityPub-based services are really private. There is no mechanism for end-to-end encryption, access-listed posts, or even true DMs. ActivityPub is intended as a microblogging-style publishing service with interaction built in, with privacy not being in the spec’s scope.

Maybe some day they’ll retrofit privacy to the protocol, but that would involve reengineering it to handle key management and end-to-end encryption, which would be a hard problem.

The Godot Engine is getting better every day.