Untitled attachment

Notices where this attachment appears

1. Embed this notice
   Terence Eden (edent@mastodon.social)'s status on Friday, 08-Mar-2024 01:07:24 JST Terence Eden

   in reply to

   Another #ActivityPub question about verifying signatures.

   A header contains:
   `keyID="example.com/user/1#main-key`

   But the body of the message might have:
   "actor": "example.com/user/2"

   How do I check that that message has been signed by the actor in the body?

   The URls might not be in the same format. So I guess back to webfinger to request the key from the actor - ignoring the one provided in the header?