@silverpill
How does it check that the user is logged in? Does it present a login form?
The user has to be logged in at his home instance before starting an OWA attempt to another instance.

What URI is being put into actor field of activity, and what URI is being put into keyId parameter of HTTP signature?
Actor is the remotely via OWA logged in actor., the HTTP requesti is signed by the thread owner.