ActivityPub
it's about activitypub protocol itself calling our real host public key to validate http signature . Is that commonly known fact and can the fediverse be improved here?
Maybe I can ask this question here? Is there any good friendica server which is well maintained and do not block lemmy.world and lemmy.ml?
When making an activitypub request from either a lemmy or mastodon server (I haven't tried others) (eg `curl https://programming.dev/c/activitypub -A 'WhizzleGig/0.1;' -H 'Accept: application/activity+json'`), for their context they include... ``` "@context": [ "https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1", { ``` (note: https://w3id.org/security/v1), and for the security portion of the record, they return something like ... ``` "publicKey": { "id": "https://programming.dev/c/activitypub#main-key", "owner": "https://programming.dev/c/activitypub", "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nBlahBlahBlah\n-----END PUBLIC KEY-----\n" }, ``` (note how `publicKeyPem` and `owner` are both nested inside `publicKey`). However, upon reviewing https://w3id.org/security/v1 and https://w3id.org/security, my interpretation is that those should not be nested inside `publicKey` but should be at the same level. Am I misreading something?