[selfhoster11]

> All metadata are still leaked: IP addresses, DNS queries, FQDNs in the TLS session opening. Also timing attacks.

That's the problem with the current iteration of the internet. If you run a Gemini-based hidden service, they go away.

> Furthermore, there's nothing that Gemini can do to prevent unofficial extensions, e.g. browsers detecting and loading HTML/CSS/javascript found on a Gemini page.

That's the problem for the client to take care of. Those clients that aren't built with web technologies are unlikely to be subject to accidental web technology execution.