Setting up a domain appears to require admin-privileges on the computer running takahe

A takahe admin can not take the identity hostage. An admin can add any domain, but if that domain does not respond to the webfinger query pointing to the actual underlying domain, it will never matter. So at the end of the day what matter is how that domain responds to a webfinger query.