@Brendanjones
The goal of the protocol is open communication, making encryption difficult. Just like how you can PGP sign emails, you can still do it but it's harder.
Also, yes, it can do private messages. Private messages basically work like normal posts, but with limited visibility. Of course not all places can send messages with a limited scope but Mastodon can. It is also possible that the recipient platform broadcasts the message, though I don't know any that do.