logging in with one account into another instance
I'd imagine a OAuth/JWT-like workflow, where pixelfed.social can ask a kbin-API whether my user exists on kbin.social.
If it does, I should be able to post images on the pixelfed app that show my username as @adonis.
Edit: by @adonis, I mean adonis @ kbin.social
Why would there need to be a signature to every post? According to your statement, any service that provides OAuth/JWT would be prone to this fatal flaw, wouldn't it?