#cskaunightpool: Thanks for the pointer. From what I can see there's only a paragraph mentioning the use of HTTP Signature and WebFinger, but not much in the way of detail. I've ended up just loading up a dev instance that I've been tracing through, which has been very helpful.