Here is my new realization. The HTTP timeout is configurable by a sysadmin. So admins can work around this.

Meanwhile, we can add a new approach for signing events to Soapbox, using WebSocket instead of HTTP.

Therefore the default setup with Soapbox will work out of the box, but admins can work around support for native Mastodon clients.

Still.. it's a lot of work and I don't know exactly what it looks like yet.