洪 民憙 (Hong Minhee)@twilliability The problem is that in addition to POST requests with an activity, GET requests can also be signed. When you receive a GET request, you have no way of knowing which actor the signed key belongs to. I asked the same question at the Fediverse Developer Network in Matrix, and we concluded that the only way to do this is to maintain a separate actor–keyId table in the server.
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.