Soooooo, a #Mastodon update. Toots can now be private, which means, visible only to your followers. In tandem with that, you can now "lock" your account, which means you'll be able to approve or reject followers, and the privacy setting would default to "private".

You can still toot publicly as a locked account if you wish. To strangers, locked accounts display only public/unlisted toots. Federation is wonky though

Currently no way for people on other instances to know that an account is locked, therefore they follow just like usual. But private toots currently don't federate at all, so the way this is handled, remote followers are simply not put on the follower list here. But they'll receive the public toots on their end.
Private toots cannot be boosted so the icon is greyed out. Locked accounts have a lock next to username on the profiles (but not in toots since it'd be confusing given locked accounts can make public toots)
I have temporarily removed the ability to "unlist" a toot from the UI (not the API) simply because I didn't want to mess with the UI components for this threeway setup
@Gargron fix asap. there is already dissatisfaction expressed <_<