@mapkyca using signed URLs is an intriguing idea, I like it! btw, indieauth doesn’t require a centralised authority — see indiewebcamp.com/distributed-indieauth