I think if you consider leaking usernames to be an important risk, there is probably some other problem. Your username can probably be easily guessed based on y

I think if you consider leaking usernames to be an important risk, there is probably some other problem. Your username can probably be easily guessed based on your email address or first and last name anyway. My point is you are better off designing things assuming that usernames and public keys are public information. That doesn't mean you have to go publish them on your website, but you also don't need to worry about mitigating it if someone else does.