[tantek]Been wondering if IndieAuth / RelMeAuth / Web Signin should suggest a user agent, and similarly for Webmention retrieval requests. That way you could add them to a low frequency allowlist and then it would be obvious if they're legit requests or a dumb bot pounding
