A few #ActivityPub questions I am hoping someone can answer for me:
How good is the support for Ed25519 keys and signatures across the Fediverse? What happens if my instance only does Ed25519 signing and another instance does not support it? What if I try to make an Authorized Fetch signed with Ed25519?
Can I use the same key pair for all users on my instance?
Is there a functional difference between using an instance actor or the admin user for Authorized Fetch signatures?
If I don't want to implement an Outbox (since it seems like the Fediverse has moved away from it), does my endpoint for it still need to exist?
What is the worst thing a bad actor could do if my account's private key is compromised?
#fediverse #activitypub #ActivityPub
JCM
npub1w3…xhna5
2026-06-26 11:58:14 UTC
Author Public Key
npub1w39aw9ujjgup924wq7ww6ler0jxduu06dg7qvpwnqyu34tgw2tjs4xhna5Seen on
wss://relay.ditto.pubPublished at
2026-06-26 11:58:14 UTCEvent JSON
{
"id": "74eaf8bbfe59a95585f6b4dac42234c2b9c0e868c4e676bb8743d181860476e1",
"pubkey": "744bd71792923812aaae079ced7f237c8cde71fa6a3c0605d301391aad0e52e5",
"created_at": 1782475094,
"kind": 1,
"tags": [
[
"t",
"fediverse"
],
[
"t",
"activitypub"
],
[
"t",
"ActivityPub"
],
[
"proxy",
"https://wafrn.jcm.re/fediverse/post/920d6df5-f608-44a7-be5f-4d2d619858b3",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "A few #ActivityPub questions I am hoping someone can answer for me:\n\nHow good is the support for Ed25519 keys and signatures across the Fediverse? What happens if my instance only does Ed25519 signing and another instance does not support it? What if I try to make an Authorized Fetch signed with Ed25519?\nCan I use the same key pair for all users on my instance?\nIs there a functional difference between using an instance actor or the admin user for Authorized Fetch signatures?\nIf I don't want to implement an Outbox (since it seems like the Fediverse has moved away from it), does my endpoint for it still need to exist?\nWhat is the worst thing a bad actor could do if my account's private key is compromised?\n\n #fediverse #activitypub #ActivityPub",
"sig": "6930f6004c4139bd5e4d4069b87cc3d135007a94d4fa644b70206aa3db134dadbb35ab1263300984bbc59c8b30f34dae24fb907cd1c101d5e9b69aeb130a712d"
}