@evan I still think there's a missing step. My thinking is...
owner.publicKey is derived from sig_key.
So if sig_key is lying about who its owner is, you're just comparing the same source twice, right?
So I *think* it should be
owner_id = get_id(sig_key.owner)
Then
if (owner_id == message.actor) ...
Does that make sense?