@mapache @tchambers yeah, seconded. Cryptographic portable identities make the whole system much more complicated and fragile. Webfinger can connect any id to any server account right now and can be a simple static file if needed. Disconnecting your user domain from the server your account runs on is a easy first step.
Plan B, just as an MX DNS entry points to the mail server that handles your domain, you could also use a SRV entry to point to a Activitypub server.