Why does OWA use per-actor RSA signatures instead of e.g. OIDC client auto-registration to exchange a shared secret between severs? If the user identity is user@example.com and example.com is authoritative on whether that identity is valid, why do you need a proof that it possesses the user's key? And if the server has the private key anyway, why have per-user private keys?

Unless you have key-based naming (userId@keyFingerprint), you have to rely on a server running at the domain to be the ultimate authority on legitimacy of identities anyway, right? Exchanging a single shared secret between servers seems like a much more lightweight way to do that.

For portability, couldn't userId@example.com publish a message saying that it is now (only-or-also) known as userId@othersite.com? If example.com had the private key at some point and you were moving permanently, you'd need to generate a new one anyway and need to publish a similar message, so why have the keys at all vs. the server just saying "yeah that's my user"?