@soatok @frost I'd definitely go with `@id`s over `@@` handles. Mastodon is the odd one out for strongly keying on the latter and it's making life much harder for other implementors if they want to allow user-visible-handle changes (which would otherwise be trivial under AP).

That said, `@id`s are definitely PII in almost all implementations too, since most use predictable name-based URLs for that. You most likely need to make the server the authority for generating primary keys on request, or someone is going to make them predictable in a way that can't be disassociated from later.

Edit: User names also aren't 1:1 for identities. There's a primary one (usually), but any number of handles can refer to a single `@id`. The most common use is probably case-matching, but it can also be done cross-domain iirc.