So the general advice seems to be, stop using federated protocol and start using... signal?
I find it hard to believe that an app that runs in electron and falls for basic web security 101 XSS exploits[1] is a more secure solution than using an encryption layer on top of a federated protocol.