@raphael I understand that, but in the model that ActivityPub follows, where you get the canonical representation of an object by fetching its IRI (which is what I thought you referenced with your first point in the grand parent), you don't really need a signature in my humble opinion, unless your threat vector is a malicious originating server, which frankly ActivityPub has no means to mitigate as things are.
@evan