Is this where that happens?

Yeah. That function is for adding instances as they are encountered. Your dev server won’t initially know about any other instances (‘trusted’ or not), but as soon as it engages with anything from ‘piefed.social’, then it will get added to the instance list and the ‘trusted’ flag will be set to True