@silverpill I'm sorry I mean https://solid.github.io/web-access-control-spec/

I am stealing a bunch of ideas that leverage web specs from Solid, but I don't like Solid itself.

so you can go from a web DID, get the keys and use them to identify a web request using a token created by the key, and using the user's DID as an ACL for some object in the service, you can control access to it. What I was trying to solve was having all my data on a separate domain and have a standard and clear way for someone listed in the object ACL list (basically maps to the to, cc, bcc etc list on the object in most cases) to retrieve that object after the fact if it wasn't already pushed to them.