@evan @davidgarywood you could start with a less audacious goal, which would be for all posts to be signed, and dms encrypted, but your home instance is entrusted with an (optionally) password-protected keypair.
so your local admin might have a shot at brute-forcing your key, but everything else just works.
actually just having a standard for publishing a public key on your profile for clients to pick up and use for signature verification and encryption could get us pretty far.