OAuth signature methods - and why HMAC-SHA1 signing sucks.

You are correct in preferring a public-key signature scheme to a shared-secret scheme. While a correct implementation of HMAC-SHA1 should resist forgery as well as RSA-SHA1, there are numerous drawbacks to shared-secret schemes in general that you noticed.

Another weakness in OAuth with RSA-SHA1 in the section you cite is that you have to implement your own PKI or other scheme for validating the source of RSA public keys. Like so many other specs, it punts on this hard issue.