Rather than running a hosted ledger on the lndhub server, and allowing members of the same lndhub server to transact with simple ledger adjustments and without going over the lightning network, fedi is creating a token that is signed by the fedi-server upon minting, and the token is immediately unblinded by the recipient. What this means is cryptographically the source of the token isn't traceable by the server admin, but the admin can see who redeemed how many sats. The same is true when a token is minted, the server admin can see who is minting how large a token. I suspect the blind signature scheme isn't actually providing any privacy in practice since the tokens transaction amounts are unique to each transaction and the minting and unblinding happen real-time almost instantaneously and at the same time and on the same server. Fedi tokens aren't exchangable between fedi servers, they are captive between participants of the fedimint. It would be pretty obvious when wallet A sends 12345 sats to wallet B and wallet B redeems 12345 sats. It looks like the blinding amounts to nothing more than a highly convoluted custodial ledger transfer because all this is happening online and while both wallets are connected to the same mint.

Instead of running the mint on lnd, the mint is running a special lightning node that has a multisig on-chain wallet. I think all this means is that you can't open lightning channels, or spend on-chain funds from the fedimint node without all three signatures. I don't know there is any requirement for three signatures to spend sats over the lightning network, which would only be restricted by a lack of a CLI to do so. Since the fedi-tokens aren't tied to a lightning channel, nor a bitcoin wallet, if all the multi-sig nature of fedi does is prevent on-chain transactions without authorization from all trusted parties, then it should be simple to add an interface to fedi for a server admin to simply spend out whatever outbound lightning channel liquidity happens to be available.