Should media repo federation requests be signed?

[turt2live]

Currently synapse does sign the request, however matrix-media-repo doesn't. There's no explicit spec requiring it to be signed, and both projects work fine when they receive a request that isn't signed.

Signing it seems like a good idea, although this should probably be spelled out.

For reference, the current signing method is written here: https://github.com/matrix-org/synapse/blob/752b7b32ed1c33651c0c64fbbb4289c3b62ac89b/synapse/http/matrixfederationclient.py#L262-L285