Nostr is only really 6 months old in its current form, so many parts are still early and actively being built. But there are a lot of builders working in a permissionless way.

You can run your own proxy. But ultimately users on mastodon dont care if their keys are leaked, anyway. They all are.