Hey, thank you kindly for this elaborately outlined post! I don’t have a need for private posts, but I know it would help so many people to have the ability to post/message privately on the Indieweb—so work on this is absolutely vital. And I really appreciate you digging into all the nitty-gritty—I’m working on an RSS reader type thing too and want to take a whack at supporting this.

One question, though—could the Atom feed list ‘rel alternate’ versions of the feed? (That would have type ‘application/atom+xml’?) It also seems like ‘rel self’ could have the non-authenticated version of the feed. It doesn’t make sense for credentials to be in that URL. These are possibly naive suggestions—apologies, if so. Again, fantastic write-up!