Pleroma and Akkoma FE can also display conversations as trees.

if I sent you a private message, is that viewable in plain text by not just the instance owner we’re both on

Yes.

other federated instances too?

Not by design, but instances can misbehave.

private messaging over AP

Private is misleading here: for messaging to be private, no third party should be able to read the messages. In practice, this usually requires end-to-end encryption.

What’s your source? (I have a feed reader and prefer its interface to that of microblogging frontends.)

Hopefully not, robbing ships and coastal areas isn’t exactly friendly to begin with.