You are better off with an encrypted password store and a 2FA on a phone. You can back up both, easily, and they are both protected with fingerprints and/or global passwords.

I did the survey but please would you mind identifying yourself and linking to the research paper when it’s ready?

signal is designed not to trust the server

Unfortunately this is not enough. A malicious Signal server can mount a timing correlation attack and infer the social graph of an user. Having a centralized server makes it more difficult to mitigate such risk.

free people from proprietary gardens, yet FOSS has actually been one of the biggest creators of such gardens

Forgive the nitpick, but FOSS is not creating walled gardens, companies are. (After all, software has no willpower… yet)

Indeed. If a big instance like lemmy.ml was to be shut down all the communities would be lost. This is simply not sustainable. Why would users put effort building a community if it could be gone at any time?