@devnull No offense taken; I get reminded of parts of the spec that I misremember all the time. But I'm pretty sure they are stripped before delivery. "The server MUST remove the bto and/or bcc properties, if they exist, from the ActivityStreams object before delivery, but MUST utilize the addressing originally stored on the bto / bcc properties for determining recipients in delivery."