Tbh I think the display names as they currently work are dangerous. What would prevent me from setting my display name to nutomic@lemmy.ml? Most front-ends would not show that I'm actually not you at first glance.
Edit: Misread the question as being about display names. Full unicode support for usernames would be even more dangerous, basically opening the door to unicode homograph spoofing on that level too.