marius@silverpill guilty on all charges.
1/ signed by the instance actor - to decouple key verification from processing the activities (and add a modicum of anonymity on behalf of whom the request is done)
2/ No preferredUsername because naming things is hard (and the instance is named through its url)
3/ mixed keys, well, I changed the instance key to mastodon compatible a while back
All GNU social JP content and data are available under the