piefed.social is hard-coded in the source as a 'trusted instance',

That's probably inherited from the past, from a time where Piefed.social was the only active instance around. Quite a few of those settings are being made customizable in the last few days, so that every instance can configure it as they wish.