uuupppss,

[mro@digitalcourage.social]

Hi @steve @naturzukunft
https://www.w3.org/TR/activitypub/#authorization refers to "The keyId should link to the actor so that the publicKey field can be retrieved."

I read this that it has to be an actor profile document holding the key.

Who says otherwise?

[steve@social.technoetic.com]

@mro @naturzukunft 2.3-4 is the case where the keyId is an actor URI fragment. 2.3-5 describes the case for where the keyId (not an actor URI fragment) references a “raw key” resource that must be verified using the owner property.