Let's just be clear: #Telegram has proven that they'll gladly accommodate nation states and probably has been doing so for years.
To think that it is secure when all the content, all the messages, are actually available to the company - albeit dispersed across nation states - is false.
#Privacy is #security, full stop. You've got #Signal for IM, #Session as well, not to mention #Matrix for group chats and servers. All have actual, factual peer-to-peer encryption and obvious key systems.
had a dream that i hacked into the matrix to turn my alarm off. woke up 5 mins later with no recollection of turning it off
Now that you mention #XMPP.. at the time that https://openengiadina.net dropped #ActivityPub support for XMPP I was tempted to follow along. So many things are better documented in that open standard and the subsequent XEP's.
Yet also both XMPP and #Matrix are first and foremost instant messaging / chat protocols, and to me using them to build other abstractions on top of felt forced, plus being among the first and only ones to do so.