@evan Yes, that's exactly how it works. When Fedify verifies a draft-cavage signature on an incoming request, it:

1. Extracts the keyId from the Signature header.
2. Fetches the document at that keyId URL, expecting a key object (or an actor with a matching public key embedded).
3. Reads the owner property of the key, which points to the actor's ActivityPub object URL.
4. Fetches that actor object to confirm the key is actually associated with the claimed sender.

So if tags.pub is having a signature-related bug with Fedify, worth checking: does the keyId URL actually resolve to a key object with a correct owner pointing back to the actor? And does the actor object at that owner URL include the public key? If either fetch fails or returns unexpected data, Fedify will reject the signature.