@helene yea but they could have the signed data be encapsulated not mixed with the signature. make sure to design it so that older versions drop&ignore it and have some grace period where mastodon would still send unsigned or http-signed messages

well, what can i say, power of FOSS