Funny you mention that private webmention is daunting to implement. For me, the opposite is true. While I haven't actually implemented it yet, I feel like making private webmentions work is just figuring out the mechanics of doing the token exchange at this point. The real struggle is figuring out how I want the UX of private posts to work when you're logged in to my site. Should you see additional posts on my home page because you're signed in? Should there be a separate place you go to see private or semi-private posts? Should I only post private posts in separate "channels"? How should the post visually indicate that it's not public? Do I want people to know that they're viewing this post because they're part of a certain group, or leave that information hidden?