@jwildeboer When the Social WG discussed about the protocol, I provided commentary. At that point in time, I already had worked with the Diaspora protocol and knew their way of distributing comments. I'm not totally sure anymore, but I can imagine that I suggested that to the WG as well.
But I guess that AP inherited their current behaviour from pump.io. Sadly also LD signatures didn't took of. So we would need a different method of authenticating especially non public posts.
@heluecht @jwildeboer you don't need signatures. Just fetch the replies collection. The OP can use 'Add' or 'Accept' activities to indicate that an object has been added to the replies.
@heluecht @jwildeboer yes it does; you have to a) use HTTP Signature authorization and b) have access to the post.
@heluecht @jwildeboer or, you know, OAuth 2.0 authorization for posts on your local server.
@heluecht @jwildeboer I wanted to make it clear that it's entirely possible to handle this case with followers-only or other private addressing. I updated the page on replies on the ActivityPub primer to explain it. I hope it helps for you!
@heluecht @jwildeboer I think there's a more extensive discussion of threading in my book, too.
https://www.oreilly.com/library/view/activitypub/9781098162733/