Actually verify incoming signatures 🤪

[snarfed]

alright alright alright fine

bridgy-fed/activitypub.py

Line 120 in 4fb36e3

# TODO: verify signature if there is one

[snarfed]

Downside: this would require fetching AS2 actors and keys for a wide range of incoming AP activities, which we don't currently have to bother with.

[snarfed]

This will be easier after #286

[snarfed]

This is working! One catch: Deletes are signed with the deleted actor's key, which we often don't have, and when we try to fetch it, we predictably get 410 Gone. We only recently started storing (and fetching) actors, so maybe those actors got sent to us before, and their instances think we should already have their keys?

[snarfed]

Those requests faded once we started fetching and storing inner objects. Sigs have all been passing for a week now.