This is untrue, Actors have a keypair and inbox POSTs are signed with that key to ensure authenticity. For boosts (Announce), mastodon uses a complex signing algorithm based on JSON-LD, and pleroma just re-requests the post from the original instance and uses that, discarding the relayed object.