onUnverifiedActivity() only runs when signature verification fails: missing signature, bad signature, or a key lookup failure. It gives you a chance to handle those cases yourself instead of Fedify immediately returning 401 Unauthorized. If the signature verifies, this hook is not involved.

If you want extra validation for verified activities, do that in your normal .on() handlers. Those run after signature verification, so that's where app-specific checks belong, like rejecting certain actors or applying your own rate limits.