2. I don’t think Mastodon will be tangibly affected because it’s too niche and not corporate.

Until you're not.

The moment a Mastodon instance is found to be hosting content the OSA is meant to protect minors from, that instance will be investigated and explored to the most liberal interpretation of the law, and that individual is going to find themselves either implementing age verification, shutting down that instance, or fighting their stance in court.

Risk, as ever, is about likelihood, not just impact. How likely are you to find yourself hosting such content? Could you self host just for you and people known to you? Your question implies you want to set up a centralised instance with lots of people you don't know, but that's the exact scenario Mastodon is meant to counter, it's meant to be federated. And if it's just you and your mates, what's the issue? If you want to give children access, you're into another World of problems, so maybe for your own sanity - and arguably, theirs - just don't do that.

If it allows unmoderated communications, it might be higher risk. See https://www.ofcom.org.uk/siteassets/resources/documents/onli...

But most of the requirements are stuff that Mastodon services should be doing anyway - responding to complaints, have a code of conduct, have moderators, perhaps use a CDN to filter out CSAM etc. See https://www.ofcom.org.uk/siteassets/resources/documents/onli...

If you're self-hosting purely for yourself, there are no users other than yourself - so no need to worry.

https://news.ycombinator.com/item?id=44710221

But since the penalty is a fine proportional to revenue, I suspect there is not much Ofcom can do about non-commercial hosting anyway.