@bcrypt @polymerwitch yes. Assume that everything on gnusocial is purely public and can be viewed by anyone. There have been discussions about having "real" DMs and my favoured option would be to have a field in the database and UI button for "contact me directly". That could then fire up your preferred xmpp client with omemo and so on. By keeping private and public as separate majesteria you can optimise for both situations.