Validate actor on incoming activities via ActivityPub federation

[evanp]

If an activity is received, check that its actor is the same as the signing key.

If not, check if it's inbox forwarding, or if it's signed by the server.