I thought #OCAP was going to save us from ourselves and the non-private no-security* protocol that #ActivityPub turned out to be. I feel like I did when I discovered that there was no Santa Claus.
* There's optional easily subverted stuff like HTTP Signatures, but nothing in the core of AP.