couldn’t a malicious instance or fork just ignore who is trying to access the data and show all the toots that have been federated at all? anything that can be retrieved by another instance is public
it’s kinda like when Steam asks for your age when looking at an M rated game