At its core, it is a bad to bet on the US state being run in a sophisticated way. It depends more on its position to exert leverage than on the smartest and best stratagems. The people "at the top" being incompetent (but still cynical) has happened many times.
Though it is an interesting question of what is going on in the intelligence blob. Sure, they havs their own batch of true believers that do not understand their actual role and what they do, but I have no doubts that those who are generally aware run the show. Does it mean they are on board with a surface-level restructuring and are betting on a different approach? Does it mean they plan to rein this in and we just haven't noticed? Are they too distracted by the loyalty purge stuff for now and will be responding later?
In any case I am very entertained to see so many imperialist propagandists out of work. Watch where they go next. That might indicate the extent to which this is a restructuring rather than defunding. Moves to academia, social media companies, and brand new NGOs are the ones to look out for, IMO.
Okay so losing the domain is actually very funny to me. I am not personally invested in us getting the domain back so long as measures are taken to ensure security (comments on MITM and the need for invalidating JWT, at minimum, are reasonable concerns).
I'll make one quick note about the donations issue. I would recommend that in the future, you distribute funds so that if someone goes AWOL you only lose, say, 20% or 40% (let's say someone else leaves with them) rather than 100%. This is how many orgs maintain funds for organizing without needing all of it to go to a legal entity or just one person.
In terms of domain registration and access, I can give a couple tips for whatever domain the site settles on.
Have all emails go to a forwarding email address that pings multiple admins' emails with domain messages. You can set up a regular ping to that address so that everyone knows it is still working every 2 weeks or so. e.g. "Subject: hexbear.net email is working". You should also make a note if when the registration expires. Domains tend to be renewed yearly and on a particular date, so you can set calendar reminders and alarms and so on to each verify that the domain has been renewed.
With some registrar services you can have multiple domain admins. There is still just one legal entity that owns the domain but you can set up multiple accounts to have access to change DNS settings, get expiry emails, etc.
This is an InfoSec risk, but you can share ownership by making a shared legal entity the owner, like a business or non-profit. The problem with this is that two people need to register the business and this effectively reveals your names and that you are associated with one another. But depending on your risk tolerance and existing social connections, it might be possible for 2 people to do this kind of thing.
Obviously there is no perfect solution. The ability of one person to change the password on any shared account (e.g. forwarded email address) would still pose a disruption risk. But doing at least the first two steps would give you a heads up on something going wrong and if you did the third you could pay on behalf of the owner (the legal entity) even if one of you goes AWOL.
Anyways, thanks again for picking up the pieces here. I'm sorry, I am sure it is very stressful. We are all comrades here. Let us know if there are ways for us to support you all.