>Why does it need to be signed and encrypted? We have PGP, Signal and Co. for that

Note it IS signed. It's just not encrypted. It needs to be encrypted, too, because it's the reasonable expectation when private messages and followers-only messages exist.

Additionally... should I be some location and post something, I'd be broadcasting my location, even if that isn't intended. All because it's not encrypted, where it should be.

>Mastodon is as trustworthy as your instance administrator, so you'll have to find a place where you can trust your admin.

That'd be true if it was peer-to-peer encrypted. But it is not; all messages are plaintext on the wire.