Per-server or global toggle for client

Not sure if it is in the scope or not, but have you considered adding a per-server or global toggle?

Mainly what concerned me is the new info you received:

To make Velocity compatible with this mod, add -Dauth.forceSecureProfiles=false to your Java command line flags (on the server side, when starting Velocity).

Previously I thought that modified servers like Paper would not/have not implemented it, per https://forums.papermc.io/threads/paper-1-19.344/

Currently, all messages will be sent as (unsigned and unverified) system messages – this has no meaningful impact on how clients display these messages yet. With Mojang trying to make the player chat more secure, we will have to make some larger additions and changes around message events and API in the future to allow features like the ability to preview formatted messages on the client.

Or at least I thought they wouldn’t force it. But since it does, the impact may be larger than expected…

[Aizistral]

Well, yeah, I assumed the same, but if it is indeed a default, then that would result in lockouts for most servers…

By default the option is false, so we probably don’t have much to be concerned with. I would advertise the mod as capable of operating in client-only mode otherwise.

Someone suggested to me that it could be warning-based instead

I think it would be best to actually make that, but in a way that warning will be shown only one time for any given server, and if the player agrees to enter the server knowing the mod will not work - it will be remembered in configuration file.

[Madis0]

What exactly you mean by “per-server or global toggle”?

I mean that the user could have an option to disable the mod globally or per-server if they still really want to join that server. Someone suggested to me that it could be warning-based instead (like “this server bad, do you still want to join bla bla”) but I feel that could create warning fatigue.

Regarding Velocity, that isn’t something I actually tested, it’s just something one of the users pointed out.

Oh, okay.

I do not think most developers of server software will touch enforce-secure-profile or otherwise try to enforce the use of keys and signatures.

Well, yeah, I assumed the same, but if it is indeed a default, then that would result in lockouts for most servers…