Conversation

@justin @jdt Verifying HTTP signature is sufficient in most cases. Are you concerned about relayed and forwarded activities? When I receive a forwarded Create/Update activity I simply fetch its object by ID, it works well.

I guess if you're following a Mastodon-style relay, that might become a problem because the number of activities is quite big. In this case, implementing LD signature verification would make sense.