@mikegerwitz trying to retrofit security onto gnusocial I think would be a mistake. Instead if folks want DMs or verified posts they should use existing secure apps which have been well tested. gnusocial should merely make it easy to look up your direct communication address. GPG key, Tox ID, xmpp, etc.