When powering up a sound system, the power amps always get turned on last so that clicks and pops from upstream devices don't get to your speakers!

I'm of the opinion that E2EE is outside the scope of this - since as you say it would preclude moderation, which is needed to keep users safe. Once people have found each other and are happy to exit the moderated system, the recommendation would be to move to some other E2EE messaging platform of their choice.

I'm not sure I understand your concern about visibility controls, since the control would always be done at the source end it doesn't matter if the receiving end is incomplete - it just gets what it gets. Perhaps you could clarify?

Of course, critical mass is a very difficult problem. My hope is that the federated nature of it means that each instance can focus on its geographical area and do targeted marketing to achieve that mass locally, rather than trying to launch and market worldwide.