practically, sufficient for keys to be owned by same domain as actor.

the url scheme doesn't matter, and need not match.
problem identified by eta.

fun.go

@@ -694,13 +694,9 @@ func savingthrow(keyname string) {
 }
 
 func keymatch(keyname string, actor string) string {
-	hash := strings.IndexByte(keyname, '#')
-	if hash == -1 {
-		hash = len(keyname)
-	}
-	owner := keyname[0:hash]
-	if owner == actor {
-		return originate(actor)
+	origin := originate(actor)
+	if origin == originate(keyname) {
+		return origin
 	}
 	return ""
 }