pull down to refresh

It'll be custodial for most people, but the important thing is it's trivially self-hostable and portable, which should keep it far more decentralized and permission-less than Google/FB/Apple Auth.
I agree. I think the biggest problem with custodial services is not that they are custodial, but that they lock users in. So as long as it's trivially self-hostable and portable (as you mentioned), it's a good way to onboard new users.