Correct. A lot of the protections in ActivityPub are listed in the spec as "should" not "must". For example edits and deletes. I think it should be assumed th

Correct. A lot of the protections in ActivityPub are listed in the spec as "should" not "must". For example edits and deletes. I think it should be assumed that when you publish content over activitypub it is now public. Any exception that it is private is asinine since you are literally publishing it to other servers.