sorry should have read the page in full, instead I just had looked for private profile option in my instance.
I have a few more thoughts.
Your proposal advise against mastodon.social and mastodon.online, because chosing it will encourage centralisation. Yet, you also say that the official mastodon app is recommended because they have a great track record on security updates.
Which does bear the question : Why should I not use their app for security reasons yet not use their instance ?