This idea that we need to rely on big Google to protect us is insane. Just make it so that messages from unknown contacts are not as annoying or even hidden entirely unless you go explicitly looking for them.

You don't need to stop federation. You don't need device attestation. These don't benefit the user. They are only there to give the platforms more control.