"They" did not go anywhere yet. This is a proposal, nothing more. It will take serious discussions over years to get this into C++.
Prominent figures already said they prefer safety profiles as a less intrusive and more C++ approach at conferences It will be fun to watch this and the other safety proposals going forward.
Github login does not help much... devs are on github, not on random forgjo instances. That's where they see your project. Github is also where they put their fork of your project when they play with it. They will write comments using github markdown and won't care whether that renders correctly or not in your forge.
And it is where they will report issues and open a PR. It is annoying, but it is how it is. When you ask them to open the PR elsewhere they complain sinde they need to set up an account there and copy ssh key and similar things. You need a very dedicated contributor to go through with all that.... especially if it is just a few lines of drive-by fixes.
That unfortunately requires setting up email... I have not bothered doing so on my boxes in a very long time.
It's just a git repo, so it does not replace a forge. A forge provides a lot of services around the repo and makes the project discoverable for potential users. None of that is covered by this thing.
I frankly see little value wrapping a decentralized version control system into layers of cryptography that hides where the data is actually stored (and how long it is going to be stored). Just mirror the repo a couple of times and you have pretty good protection against the code going offline again and you are done. No cryptography needed, and you get a lot of extras, too.
If you do not like github: Use other forges. Self-host something, go to Codeberg or sourcehut, use something other than git like pijul or fossil, or whatever tickles your fancy. Unfortunately you will miss out on a lot of potential contributors and users there :-(
But if the key is fully wrench-safe inside the TPM. You do not know it, you can not get convinced to give it up -- even after repeated wrench use.
Of course the recovery key that typically goes with it and you logging password is not wrench safe, so that does not protect the system fully, while getting you a matching set of broken kneecaps.
Add a /var partition, boot from some live system, copy over the data, delete it in the root partition after making sure it was copied ok and add the new filesystem to fstab. /var is the only place we that will grow significantly(especially when younuse flatpaks).
might want to look at the more "advanced" distributions that let you choose the init system.
Yeah, sure... integrating a init system is a huge task (if you want to do it properly). Let's do that several times!
Oh, the repository are easy to move.
The bug reports, PRs, wikis, CI/CD are stuck in github though. There is a huge lock in.
Maybe the Mac uses full disk encryption? Clonezilla will clone everything incl. the empty areas as the entire drive contains data indistinguishable from random bits in that case. Encrypted data also does not compress.
After applying an update you need to make sure anything using the unmatched code is replaced by the patched code. A reliable way to do that is a reboot. Actually a reboot is pretty much the only reliable way to do that.
So I am not surprised that a distribution targeting end users asks for a reboot.
You said Lennart is obnoxious and there is nothing like a big "that is not my problem" to not get your project adopted.
IMHO he does manage to get his projects widely adopted. His personality does not seem to have the effect you claim it has.