Are there any protections against spam? (unsolicited notifications) Are there any authorization & authentication measures? (so you know a notification is reall

Are there any protections against spam? (unsolicited notifications) Are there any authorization & authentication measures? (so you know a notification is really from whom it claims to be) I see mention of HMAC in the overview, (how) does it solve those problems? I know basics of TLS, RSA - how is it related? I'd be grateful for hints. Also, I remember some alternative mentioned in old threads about Diaspora, which was reportedly devised by some security guys (?) and tried to have good security model - do you know the name of this project? Some GNU one?