But do we need some kind of SSO layer with DID verification? All I need to prove my identity anywhere, technically, is my private+public keypair. As long as I hold on to this keypair, distribute it between apps/computers, back it up, I could log in anywhere on a federated platform and use it.

I hope we're going to see key-based decentralized identity on ActivityPub at some point... Having accounts tied to instances is just not very robust or scalable.

The main blocker, at least so far, was Lemmy is designed mainly to use use Docker containers to version itself and its main dependencies like Postgresql, while YunoHost runs on the bare system. And since YunoHost is still on Debian 11 it only has access to Postgresql 13 while Lemmy now wants 15. This unfortunately is hard to resolve. YunoHost doesn't want to introduce Docker, and upgrading the entire platform to Debian 12 is slowly happening but it's a lot of work.