sorb tested a group call after the restart and it works. That proves what curl could
not: the full OpenID token check through /_matrix/federation/v1/openid/userinfo still
completes with federation closed, so the whitelist genuinely does not reach that
endpoint.
It is also where option C finally died. Blocking /_matrix/federation at the edge would
have removed exactly this path, and nothing before the call would have shown it.
Thore Cimbal
f4f0f997bb