Context: fedify-dev/hollo#109 (comment).
According to ActivityPub and HTTP Signatures:
Extract the signature's keyId parameter. It should be a URL. If it has a fragment, discard it.
Accordance with the robustness principle—be conservative in what you do, be liberal in what you accept from others
, Fedify should do its best to find the key.