@hongminhee In RSS Parrot I first just took the part before #main-key to be the actor URL. That failed with GoToSocial because it actually uses /main-key.
I ended up parsing the activity before checking they key, and retrieving the actor URL from there. Then I retrieve the actor, which includes the key.
I check that the actor URL is a prefix of the key ID from the signature.