@mcv
> Is follower-only a thing on ActivityPub?
Yes. They're called Followers posts in Mastodon now.
> I thought everything was unencrypted and basically accessible to any server that receives it.
Yes. There's been all sorts of research into things like Object Capabilities, that could force receiving servers to do what they're told. But for now, not displaying Specific People posts publicly, or showing Followers(-only) posts only to followers, is an unenforceable handshake agreement.