or rather, even more secure, because the current AP standards document doesn't mandate any kind of signing, so you have no idea if an incoming message is authentic, aka the thing that salmon does in ostatus.

of course mastodon implements a mechanism for that, but it's not in the standard.