@miyagawa I guess the decision by Mastodon was to make toots as simple as possible to make it easier to read as plaintext. It's a pity that rendering to HTML is done inside the server. Glitch Social might have a parameter sent with the POST request to communicate the format but I'm not sure.
I believe allow-listing HTML tags is already done on the client side to reject harmful HTML code sent through ActivityPub.