Lemmy does not seem to include any kind of authentication on the user level (such as a user keypair and signatures using that on their posts and comments client-side) so allowing one user from a remote instance would at least trust the owner of that instance to not impersonate the user who is allowed to post.
In fact, how does ActivityPub in the threadiverse even ensure that the instance is who they say they are? The W3C document on it seems to indicate that there is no standardized way to authenticate servers to other servers yet.
Lemmy does not seem to include any kind of authentication on the user level (such as a user keypair and signatures using that on their posts and comments client-side) so allowing one user from a remote instance would at least trust the owner of that instance to not impersonate the user who is allowed to post.
In fact, how does ActivityPub in the threadiverse even ensure that the instance is who they say they are? The W3C document on it seems to indicate that there is no standardized way to authenticate servers to other servers yet.