@macgirvin @strypey The way this question is couched essentially boils down to "why don't you treat ActivityPub connections as hostile?"  The answer is that yes, I can do that, but I prefer not to connect to hostile sources to begin with.