(Hypothetically) wouldn't it be possible for client devices to generate key pairs, and for messages to be stored on the server encrypted in such a way that recipients' client devices could decrypt them? (I think that's what Signal does?)
Not saying that that's what happens on Mastodon instances, I don't know enough about it's operation to comment.
Yes, end-to-end encryption is possible. It just needs support in clients, as well as a common protocol if you want it to work between different clients.
Not saying that that's what happens on Mastodon instances, I don't know enough about it's operation to comment.