Mastodon rejects the activities sent by XWiki: the HTTP signature keyId is not the id of the actor public key

Problem

Activities sent by XWiki (e.g. a Follow, or a Create carrying a message) are rejected by Mastodon with a 401, so following a Mastodon account or messaging it from XWiki silently fails:

Error when performing [POST] on [https://mastodon.example/users/alice/inbox]:
200 status code expected, got [401] instead with body:
[{"error":"Public key not found for key https://xwiki.example/activitypub/Person/xwiki%253AXWiki.bob"}]

Cause

The actor advertises its public key under the id <actor id>#main-key, but the HTTP signature of the outgoing requests uses the bare actor id as keyId. Mastodon looks the key up by the exact keyId, finds no key with that id and rejects the request.

Fix

Sign with the id of the public key advertised by the actor, falling back to <actor id>#main-key when the actor has no public key id.

Reproduced with Mastodon 4.6.3.