As someone that's about to go swimming in IETF for a week, I sympathize.
When I went reading through the activitypub specs a while ago, identity mechanisms were one of the things I had gone looking for and not found. PKI is where this stuff usually goes, and that's a very messy landscape.
At some point I was hoping to have time to go look at prior writing AP has been pondering for such things.