

The Free Software Foundation requires “CLAs” as well. I have no fear that they’re going to rug-pull. I don’t think we can use that as the indicator. IMO, it’s even a good idea to have a CLA so that’s no conflict that the project owns the code.
The warning for me is if the project is run by a company, especially a VC-backed company. Joplin isn’t, so I would be comfortable using it (although I don’t).
There isn’t just one christian god. Who the christan god is depends on which accounts you consider.
It’s easy to read the old testament, read the post-gospel books, listen to the 2000 years of doctrine, and come away with the opinion that the christian god is evil. If you just read the gospels though, and accept that part of the message is: “I’m throwing out the old deal, the new one is Love One Another,” it’s harder to maintain that argument.
I was raised Lutheran, and am currently a philosophical agnostic. I know people who have an internally consistent belief in a good and loving christian god based on how they interpret the entire body of work (they’re well studied). I also believe their definitions of “good” and “loving” would align with yours.
New thought just now:
Sorry for the long reply. You got me to extend my thinking and that came out in the comment.