@tom a quick check list for you:
1. Check if the actor is publicly accessible from the internet.
2. Check if it has a RSA private/public key.
3. Check that if you have a proxy in front of ONI it doesn't mangle Accept/Vary/Content-Type headers.
4. Check that if you have a proxy the `/.well-known/webfinger` route is handled by ONI. (your proxy should forward all routes to ONI directly as a start)
