@yerald I don't think ActivityPub is relevant to the browser; is it? Two instances talk to each other via ActivityPub but clients speak various other protocols to their home servers. It might be useful to make your browser speak the Mastodon protocol, but that's not (AFAIK) a w3c standard, so it's probably more appropriate to be housed in an extension.

For example, if I want to favourite your post from my phone, my client tells QOTO about it via the Mastodon protocol, and QOTO tells SocialCoop about it via ActivityPub. SocialCoop has no way to authenticate my identity (my password hash and 2FA secret are stored only on QOTO's hardware), so even if I had a tool that let me send the corresponding ActivityPub message directly, there's no way to prove that it really came from me.

Am I missing something?