ActivityPub

it's about activitypub protocol itself calling our real host public key to validate http signature . Is that commonly known fact and can the fediverse be improved here?

Maybe I can ask this question here?

Is there any good friendica server which is well maintained and do not block lemmy.world and lemmy.ml?

When making an activitypub request from either a lemmy or mastodon server (I haven't tried others)

(eg curl https://programming.dev/c/activitypub -A 'WhizzleGig/0.1;' -H 'Accept: application/activity+json'),

for their context they include... "@context": [ "https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1", { (note: https://w3id.org/security/v1), and for the security portion of the record, they return something like ... "publicKey": { "id": "https://programming.dev/c/activitypub#main-key", "owner": "https://programming.dev/c/activitypub", "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nBlahBlahBlah\n-----END PUBLIC KEY-----\n" }, (note how publicKeyPem and owner are both nested inside publicKey).

However, upon reviewing https://w3id.org/security/v1 and https://w3id.org/security, my interpretation is that those should not be nested inside publicKey but should be at the same level. Am I misreading something?