I’d also call out that activitypub has the same threat model in the form of ICANN, as it’s also heavily dependent on DNS for identity. I believe these are reasonable trades to make; realistically the alternative is to use a blockchain, which few people are keen to do.
Not necessarily – there are some activitypub instances without hostname, directly on IP addresses, and there are even some running in private DNS roots.
