Federating from local communities #4. You have this as #22, but I've never seen any problem with signatures. I'm subscribed to /c/playground from a server that just dumps out activity into a file, without even checking the signature, so I'd say it's a problem of not being sent at all (I see the activity from local users, but not from remote users). I've had success in test environments for this, but not piefed.social.
Improving error messages #24. More get_requests should be surrounded by 'try ... except', so it doesn't crash / say 'oops, something has gone wrong' if, for example, you enter an unresolvable domain in that form.
Subscribe to anything #20 is something people want.
Mitigate impersonation attempts (related to #52). Piefed doesn't currently check that the domain in the id and the actor's domain match. See this post, where the 'original on lemmon.website' points to a bbc news article. Technically, communities can announce anything - we can check that it is the community actually sending it, but not whether what it announces actually happened. Matching domains helps, so users can verify for themselves.
I need to investigate setting up piefed in production, partly because I keep blowing through my ngrok quota, but mostly because many of the Issues on codeberg don't become apparent or relevant in testing.
I agree with you that getting the fundamentals right for what is currently here is way more important than trying to change it into something else (i.e. do a few things well, rather than lots of things badly)