The reason being that federation means other instances send you things. It’s not pull-only, or else you could likely get away with private instances sitting behind NAT. But since activitypub involves publishing to inboxes from source to destination, they need some way to reach you. And since we want to validate that connection and that some external authority can vouch for ita ownership, we use TLS Certs with the DNS hostname that matches your server name.