Hexbear.net stays winning, external embeds are domain whitelist-only until pictrs adds proxying support, and blurred by default.
Good PSA tho, I’d honestly encourage other instances to do the same but it requires dev effort that I know not everyone has, and upstream isn’t quite as paranoid about this stuff.