but then for stuff that crosses legal lines or is attacking the network or similar, bluesky mods are able to remove from the relay and appview directly

How does this play with the concept of eventual full decentralization when there will be multiple relays, if an appview subscribes to multiple relays, but they're filtering data differently?

Is this all building to a trolley problem punchline?

The drawings help a lot, thank you

So would these be the appview mods or the atproto mods? In the unlikely event that bluesky pbc went rogue or went under for whatever reason, if another appview spun up would they have their own little guy there stopping from getting to the relay and bypass your mods?