Something I can't figure out from Mastodon's website is where and how it uses cryptography.

I fear it might all be plaintext, despite the insanity of doing that in the present post-Snowden world, rather than the appropriate end-to-end combined with point-per-point encryption.