@hrefna This all sounds generally reasonable. The trouble I have with bridging to other protocols is that:
1. They sometimes have different assumptions around consent—like Bluesky's assumptions around personal data processing; and
2. It's not always clear how our consent revocation tools (e.g. domain blocks) will interoperate with their system (e.g. decoupling account identity from host domain).
If nothing else, the uncertainty around those things seems to call for a consent-based approach.
@lrhodes That is also true for other ActivityPub services. In fact it is completely analogous: there are very limited requirements for what other servers do here.