@Lunaphied I think the spec could do with calling out this hazard + it would perhaps be good (long term) to sign ActivityPub responses