Added new requirements to FEP-fe34:
https://codeberg.org/fediverse/fep/pulls/672
Previously the FEP put the burden of C2S validation solely on the originating server (producer), but I think it would be better to do corresponding security checks on the consumer side too:
- When fetching an object: verify that Content-Type includes one of the AP & AS media types.
- When verifying a signature: also perform same-owner check and verify key ownership.
Both are already considered good practices in the Fediverse.
I also attempted to clarify how fetching from origin (authentication) is related to access control (authorization).
