With #3, someone correct me if I am wrong, but I don’t believe your run-of-the-mill moderator can see upvotes and downvotes. But instance admins can, just by nature of having access to the server data. Federation wouldn’t work if instances couldn’t communicate upvotes and downvotes across the platform to other instances, so short of finding some way to encrypt all the data, it’s an unavoidable consequence of the standard.