There are two methods:
- "Double knocking". You try elliptic curve first, and then RSA if the server returns 401. The number of attempts increases as more signature types are added.
- Capability negotiation ([FEP-844e](https://fediverse.codeberg.page/fep/fep/844e/ )). Less wasteful, but doesn't work well for GET requests (authorized fetch).
