You mean the kind of central authority that can censor accounts at the behest of a despotic government? Bluesky is not decentralized in any meaningful sense.
https://www.turkishminute.com/2025/04/17/bluesky-restrict-ac...
https://www.turkishminute.com/2025/04/17/bluesky-restrict-ac...
They landed on country-specific moderation, which is all publicly accessible and documented, allowing countries to label specific posts/contents and have them hidden in the country. Again, this is only on the Bluesky client; other clients can ignore the 'hide' label if they choose.
This is an article that details it pretty well and links to a few tools that allow you to view everything hidden by any country moderation team: https://fediversereport.com/bluesky-censorship-and-country-b...
And then "soft forks" like https://deer.social/
Why would there be no 2FA options, like when using https://element.io for a homeserver?
They've recently added OAuth, but since it's pretty new, a lot of older projects haven't moved over yet.
2FA exists but only for emails right now, more to come. https://github.com/bluesky-social/social-app/issues/1071