As far as I know, the identity is just a public key. You can add contacts only by either scanning a qr-code disayed on your contact's phone in person or by being introduced to each other by a mutual contact, so there is no real need for discovery. As there are no servers at all (not even federated), this also means that no one can even enumerate users.

Torsten Grote, one of the projects main developers, explains the technology behind it in this very nice presentation: https://m.youtube.com/watch?v=Dr42vZIoGqM