Re: HTTP Signature CG report

> If clients have custody of keys, then `foo@example.com` could wait for `
bar@example.com` to make a post, and then sign an activity with the same ID
(e.g. "example.com/posts/102930")

Wait, that's not how client signing works tho. The whole point of client
signing is that nobody else can sign with the same ID (cause they don't
have your keys).