@alex I still think the biggest hurdle in AP is HTTP Sigs. They're horrible for so many reasons and have been abused.

JWTs are better for signing an verification by a long shot.

But why people haven't moved away from it? Mastodon being the bottleneck of fediverse as always.