ActivityPub - Is it worth defending against replay attacks and message/signature time skew?

Here's a problem that I've found with ActivityBot - my little ActivityPub server. Sometimes it receives messages which were originally sent months ago. Why does that happen and is it risky to accept and process them? My tl;dr is that it probably isn't worth worrying about. But I'd love someone to tell me why I'm wrong. Here's my thinking: Table of ContentsCausesIs that a problem?What are we trying to protect against?Putting it all togetherNo! You're wrong and I can prove it! Causes All ActivityPub messages should have a "published" timestamp in their body. Some will have an "updated" timestamp. That tells you, unsurprisingly, when the message is alleged to have been originally published or updated. That time might be very different to the time you receive the message. There are, I think, three different reasons why a server might receive a message which has an out-of-date timestamp. The first is that sometimes servers are just slow. Processing thousands of messages at the same time…