ActivityPub leaks EVERYTHING. It was designed for a different GNUey microblogging network that didn't have the concept of direct messages. Don't trust anything you post on here is private really.
From a disgruntled fediverse user, to the Bluesky people