amber already signs these ephemeral events (AUTH) i'm sure, that's not the issue, almost no clients actually do it properly