Yes, signing get requests helped, thanks. This also fixed federation with gotosocial, they require get requests to be signed too (I was lazy to fix it). But in case of required signature threads.net should respond with error like 401 unauthorized like gotosocial does.