The client side is its own beast. See https://github.com/soatok/mastodon-e2ee-specification?tab=readme-ov-file#components from my initial project (the "key transparency" thing from today slots neatly into the "Federated PKI" hole).