ostatus, Mastodon's base protocol, wasn't written with privacy in mind. It was written with the assumption that a poster would want everyone to be able to read the post, like on a traditional blog. The privacy features built onto Mastodon came out of early user demand and have proven immensely popular, but they're sort of birdhoused onto the protocol and not in the spec. It's time to consider formalizing these features in an RFC or similar document to improve on them.
@npd you might want to talk to @mmn and @mattl about this -- they could probably be of more assistance