So much this it's painful. You will never be thanked for telling them uncomfortable truths, even if they -don't- know. Even the private conversation is dangero

So much this it's painful. You will never be thanked for telling them uncomfortable truths, even if they -don't- know. Even the private conversation is dangerous; as you say, keep it as low key and minimal as possible ("i have some concerns about the timeline" is literally all you should say unless they ask, and your answers to any followup question should be equally circumspect). Instead, as others have mentioned, just make sure you document what does get done. Ideally have a decent backlog of things that need to get done, but that presumes a PO who does their job (and it sounds like he/she probably isn't). That's your CYA, and your innocent response if they ask why you didn't raise the alarm.