First thing I saw, too, before giving them temporary JavaScript execution privilege.

It's one thing to be JavaScript-rendered only. It's another to be impolite to users who happen to constrain JavaScript privileges of yet-untrusted sites. This seems especially relevant since you are attempting to convince an audience to adopt a federated opensource platform. The Venn diagram of people who understand the value of federated platforms has greater than average overlap with those who restrict JavaScript execution in their web browser.

I recommend revising the <noscript> tag to say something like "Please enable JavaScript to read this content. We use JavaScript for the following ... [a brief summary] and we do not use any third-party hosted script." (Incidentally bravo on not using third-party scripts!)