I'm not an expert on ActivityPub, and I don't think associative guess-arguing by comparing all the things is very productive.
1. In Pubky, you choose how much you want to trust in how you apply and use the system. It's all backstopped by the fact that you control your own public key domain. From there you can make any sort of system you want, sign everything, dont sign anything, run mirrors and data watchtowers, there's nothing stopping anything, it's just a new web, thanks to self-sovereign DNS.
2. This is nonsense, ALL servers are permissioned, whether its relays or homeservers or hosted or self-hosted. Pubky handles application use cases by supporting modular indexers. Choose or create an index, and if you ever wanna verify the data, check the source homeserver.
The idea that nostr is, or web tech needs to be, "implicitly trustless" is also nonsense. Networked use cases always apply trust, particularly if you aren't entirely self-hosting (but you could in Pubky if you wanted).