That would be optimal, but I don't think it's strictly necessary. The fundamental requirement is that, if the owner of an instance behaves poorly, users should

That would be optimal, but I don't think it's strictly necessary. The fundamental requirement is that, if the owner of an instance behaves poorly, users should be able to move elsewhere without being cutting off from the larger network.