⁂

@mariusor @hongminhee yes, it should be a separate ticket.

I don't like your proposal for multiple reasons:

1) It doesn't include addressing, so the upload server doesn't know how to enforce authorization requests. Is the file for followers? Only addressed accounts? The public?

2) What happens if the client doesn't post the `Create` activity?

I think it's better to keep it all in one transaction together.