Embed Notice

@mariusor @Marius The problem with submitted public keys is that client controls the secret key. It can make signed requests and retrieve private objects, bypassing the server.

If the owner is not verified, the client can impersonate other actors on the server and retrieve private objects that are accessible to them but not to the current user (e.g. DMs).