#DMs or direct messages are not encrypted on #Switter and as a result are basically the same as a public message. The difference beween a #DM and a public message is that a direct message has a flag to mark it as a direct message. When the mastodon servers see the DM flag, they suppress the message and do not display it publicly. So, when you see "Post to mentioned users only" is not as if you are sending a private, encrypted message to that user. Use protonmail.com to send private messages.