> But federated authorization is one of the things ActivityPub doesn't define, and leaves it to us to figure out.

this is the key bit, atproto has this. sidecar services like knot can use service authentication[0] for authenticated requests.

[0]: https://atproto.com/guides/auth