Thank you!

onUnverifiedActivity() only runs when signature verification fails: missing signature, bad signature, or a key lookup failure. It gives you a chance to handle those cases yourself instead of Fedify immediately returning 401 Unauthorized. If the signature verifies, this hook is not involved.

If you want extra validation for verified activities, do that in your normal .on() handlers. Those run after signature verification, so that’s where app-specific checks belong, like rejecting certain actors or applying your own rate limits.

It’s on the roadmap, but not yet.

Thank you for your advice. As you mentioned, Fedify currently has actor URIs consisting of handles. This limitation is due to the early design of Fedify and will be fixed before we release v1.0!