Yes, it's P2P by default. It's all TLS-encrypted and I've not come across anything suggesting syncthing's implementation is suspect, since most of it is just us

Yes, it's P2P by default. It's all TLS-encrypted and I've not come across anything suggesting syncthing's implementation is suspect, since most of it is just using Go's libraries. You can also run your own (private or public) discovery and/or relay servers. I agree that this is adding in two additional levels of complexity, including managing an online account which could be compromised, just to avoid exposing a single service to the Internet. At first glance this seems to be undermining the idea of keeping the network secure. One could even have the reverse proxy on port 80 forward requests to Syncthing on the inside.