I didn't want to do this unless we had to but Mastodon is introducing requirming signed requests soon, so even if a user doesn't use bitbot as an instance, we'll still need to be able to serve Actor (and key) over the REST API