Yeah, you're missing something. 'Like' is a kind of message on ActivityPub, and it can be sent from one instance to another (decentralized like email, not dist

Yeah, you're missing something. 'Like' is a kind of message on ActivityPub, and it can be sent from one instance to another (decentralized like email, not distributed like BitTorrent). All messages are signed by the originating server (using HTTP Signatures [0]), so you can verify that the message is actually being sent by that instance, that it has not been tampered with, and that the user the message is attributed to is a user on that instance. There's also an option in the spec to sign message contents with JSON-LD signatures[1] using a key pair specific to the user. Mastodon and Pleroma don't use these because they're considered unnecessary and may have certain drawbacks. [0]: https://tools.ietf.org/id/draft-cavage-http-signatures-01.html https://tools.ietf.org/id/draft-cavage-http-signatures-01.ht... [1]: https://w3c-dvcg.github.io/ld-signatures/ https://w3c-dvcg.github.io/ld-signatures/