@evan Also, if it'd help to dig deeper, Fedify ships a couple of CLI tools that might be useful here:

• fedify lookup will fetch and display the actor object, including the public key and its owner field, so you can quickly see whether the key document looks correct from the outside.
• fedify inbox spins up a temporary public ActivityPub inbox and lets you send activities to it from your server, so you can observe exactly what Fedify receives and whether the signature verifies.

Both are in the @fedify/cli package. You can install it with:

npm install -g @fedify/cli

Or grab a standalone binary from the releases page.