An update to C2S authentication mechanism in FEP-ae97:
https://codeberg.org/fediverse/fep/pulls/618/files
Signing requests with a DID is easy, but it doesn't work for access control, because for that we need to know the exact actor (same-origin policy can't be used for access control because proxyUrl ActivityPub endpoint allows making requests with server's authority).
Therefore we need to add a verification method to the actor object, but it is important to use plain ap URIs for its id. If a client controls a key with the server's origin, it can impersonate other actors on that server (in origin-based security model).
fep-ae97-client was updated to sign requests with actor's key.