bluesky (or rather the underlying protocol, ATProto) is not actually decentralized. all public identity keys (signature keys) reside with a single entity (some non-profit organization in switzerland). if they get hacked, the hackers can forge any identity they want to.