Following the FEP-fe34 update, I am publishing a new version of FEP-ae97: Client-side activity signing
https://codeberg.org/fediverse/fep/pulls/564
The registration process is completely different now. Keys for signing S2S requests are generated on the server and only public parts are shared with the client.
When FEP-ae97 client retrieves activities from the inbox, it signs GET requests with a key associated with actor's DID authority.
For example, this actor:
ap://did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK/actor"
Will generate an HTTP signature with this keyId parameter:
keyId="did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK#z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
Implementations have been updated too (Nomadic AP Client and Mitra).