Just a random thought experiment. Let’s say I have my account on a lemmy instance: userA@mylemmy.com. One day I decide to stop paying for the domain and move to userA@mynewlemmy.com, and someone else gains it and also starts up a lemmy instance.
If they make their own userA@mylemmy.com, how do federated instances distinguish who’s who?
Have I misunderstood the role of domain names in this?
But does ActivityPub actually have public keys? That would need to be in the protocol I think.
It would need to be added, but the protocol is extensible … and in less obnoxious ways than applying PGP to email.