Personas prove what goes to relays; the server says what it reads

FEP-521a and FEP-8b32. Every persona has an Ed25519 key of its own (Avatar.SigningKey; migration 014 gives the earlier
ones theirs), named in its actor's assertionMethod as a Multikey, the terms defined in the actor's own context. A
persona's activity going to a relay carries an eddsa-jcs-2022 proof (JSON canonicalised by RFC 8785, Jcs), so what
Activity-Relay forwards reaches Mastodon, which verifies it with its own code. Nothing else carries one: Mitra takes a
proof over the HTTP signature and refuses one by a key it has not read, without reading the actor again. Received: an
actor's own Multikeys are kept, and a forwarded activity whose proof one of them verifies is taken as it came instead of
being read again from its origin.

Discovery: WebFinger for the server's origin links its instance actor (FEP-d556), NodeInfo links it as the application
actor (FEP-2677), and actors name RFC 9421 under implements (FEP-844e).

Checked live: relay 16 (Activity-Relay's forward of alice's post reaches Mastodon), Mitra, GoToSocial and Mastodon
unchanged (165 in all).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

PrivaPub/Federation/Actors/ActorDocument.cs

@@ -40,6 +40,7 @@ namespace PrivaPub.Federation.Actors
 		public List<CustomEmoji> Emojis { get; init; } = new();
 		public Dictionary<string, string> Fields { get; init; } = new();
 		public IReadOnlyList<ActorKey> Keys { get; init; } = Array.Empty<ActorKey>();
+		public List<Models.User.AssertionKey> AssertionKeys { get; init; } = new();
 		public List<string> Features { get; init; } = new();
 
 		public ActorKey Key(string keyId) => Keys.FirstOrDefault(k => k.Id == keyId);
@@ -81,6 +82,7 @@ namespace PrivaPub.Federation.Actors
 				Icon = root.TryGetProperty("icon", out var icon) ? RemoteActorService.Text(icon, "url") : default,
 				Discoverable = !root.TryGetProperty("discoverable", out var discoverable) || discoverable.ValueKind != JsonValueKind.False,
 				Keys = ParseKeys(root, id),
+				AssertionKeys = ParseAssertionKeys(root, id),
 				Indexable = Flag(root, "indexable"),
 				Locked = Flag(root, "manuallyApprovesFollowers"),
 				Memorial = Flag(root, "memorial"),
@@ -121,6 +123,32 @@ namespace PrivaPub.Federation.Actors
 			return fields;
 		}
 
+		const int MaxAssertionKeys = 5;
+
+		// its Ed25519 keys (FEP-521a) its document holds, as Mastodon reads them: Multikeys it controls, under its own id
+		static List<Models.User.AssertionKey> ParseAssertionKeys(JsonElement root, string actorId)
+		{
+			var keys = new List<Models.User.AssertionKey>();
+			if (!root.TryGetProperty("assertionMethod", out var methods))
+				return keys;
+			var candidates = methods.ValueKind switch
+			{
+				JsonValueKind.Object => new[] { methods },
+				JsonValueKind.Array => methods.EnumerateArray().Where(k => k.ValueKind == JsonValueKind.Object).ToArray(),
+				_ => Array.Empty<JsonElement>()
+			};
+			foreach (var key in candidates.Take(MaxAssertionKeys))
+			{
+				var keyId = RemoteActorService.Text(key, "id");
+				var publicKey = Signing.IntegrityProofs.FromMultikey(RemoteActorService.Text(key, "publicKeyMultibase"));
+				if (RemoteActorService.Text(key, "type") != "Multikey" || RemoteActorService.Text(key, "controller") != actorId
+					|| keyId == default || !keyId.StartsWith(actorId + "#", StringComparison.Ordinal) || publicKey == default)
+					continue;
+				keys.Add(new Models.User.AssertionKey { Id = keyId, PublicKey = Convert.ToBase64String(publicKey) });
+			}
+			return keys;
+		}
+
 		static List<ActorKey> ParseKeys(JsonElement root, string actorId)
 		{
 			var keys = new List<ActorKey>();