@silverpill in regard to authentication: isn't it sufficient to trust the sender at last? In this case the context owner?

Let's assume this situation: an actor is remotely authenticated at a server via OpenWebAuth and comments on a post there. No proof can be added and the object is not yet available at the actors origin server. In this case the message will be rejected allthough its authenticity is verified.