At this point we're not fetching a user profile for the UI so the URIs shouldn't be signed here. I think the bug is in the comment and message code where it assumes `ctx.user()` is a UI representation, so the signing of the URIs should be done there.