Yeah, I agree. All mod actions should be signed by their cryptographic key, and moderator cryptographic keys should probably be separate and stronger than regular user cryptographic keys. Mod actions should be rare enough that this isn't a burden to verify.

One thing I'm not as sure about is if the data is decentralized as well, users would potentially be liable for illegal content. I suppose there could be a system that moderator-removed content gets removed from all regular users' devices, so maybe that's good enough. But then that makes auditing mod actions difficult, since the original data could be much harder to get.

A lot of these problems aren't really technical, but rather UX when designing for a fully decentralized system.