PPA does not involve sending information about your browsing activities to anyone. This includes Mozilla and our DAP partner (ISRG). Advertisers only receive aggregate information that answers basic questions about the effectiveness of their advertising.

Source.

With what? Where would you store the encryption key for the encryption key on a desktop system where it would not be accessible to an attacker?

Perhaps there could be a pin or password that must be entered every time to decrypt it into memory.

Happy to see more apps offering convenient flatpaks.