What confuses me is that Misskey happily opens remote posts in it's web UI, even if you are not logged in
What scares me is that it lets me resolve those posts by those URLs? Do they also do it if I have AUTHORIZED_FETCH enabled? (like this instance)

So far I couldn't resolve my own posts remotely: I'm not sure if it's because it's my instance or because of AUTHORIZED_FETCH.
If someone else has it enabled, let me know, we can test it (gts doesn't federate with mk at the moment)