The difference, I think, is that with federated system you can have a partial state where you communicate securely with those that have also adopted the securi

The difference, I think, is that with federated system you can have a partial state where you communicate securely with those that have also adopted the security extensions, while making insecure connections with those who didn't, all within the same application/protocol (by using protocol extensions). Therefore, such features can be gradually adopted by an increasing amount of users. If the system is centralized and it doesn't support security, it's all or nothing; to enable secure protocols, both you and the other party must change to a different app, and you'd have to support both systems in order to communicate with secure and insecure users.