- The receiving server can't use the HTTP signature because it can't check Key.owner == Activity.actor when there is no actor.
- The receiving server can't verify activity by fetching it from the origin, because there is no id

Maybe this batch-Add activity is a special activity that differs from all other activities and should be unwrapped without authentication? In my opinion, the case for such "special activity" is not sufficiently strong.

@technical-discussion