Embed Notice

Another #ActivityPub question about verifying signatures.

A header contains:
`keyID="example.com/user/1#main-key`

But the body of the message might have:
"actor": "example.com/user/2"

How do I check that that message has been signed by the actor in the body?

The URls might not be in the same format. So I guess back to webfinger to request the key from the actor - ignoring the one provided in the header?