@lanodan oh im not thinking of anything complex here
Just when receiving a POST into the inbox with a HTTP Signature which isn't same-origin with the activity being posted, rather than discarding the activity one should re-fetch it from origin because it might be outbox forwarded
(of course this only works if the activity has a dereferencable URI)