@msh @sean @Are0h @jalcine @jdormit
Mastodon indeed has caused some minor damage with their AP implementation by moving too quickly, but I think it's minimal compared to the overall under-specification that has occured.
It should also be noted that Mastodon's damage is also in part because Gargron and company were given bad security advice by the W3C Social CG.
The fact that we have to push for a mitigation in the form of rotating keys due to Mastodon's decision to adopt the highly flawed LDSigs signature scheme is an example of the damage caused by moving too quickly.
But we are moving towards mitigating those problems with Blind Key Rotation.
Of course, in an ideal world, no implementation would use LDSigs, and maybe we will eventually convince people to stick to constructions which make sense instead of just copying what Mastodon does.
But here's the thing, Chris wants to move away from technologies that work and towards the experimental stuff. I wish him all the best, but we need to ship things which people can believe in wrt trust & safety, and where we're at right now is not so great for that. I think before we start integrating I2P and DAT we should talk about getting the fundamentals right.