Possibly! I’ll have to look more into the spec for ActivityPubs — I think the spec is designed for the mechanism to serve as a primary communication channel, rather than just as a method to signal, but it may be amenable to this situation.
Possibly, though I think this would complicate the system quite a bit — the inbox extension would need to hold a private key associated with the gaia hub storage bucket it is writing to, and then the user would have to communicate a different URL for the inbox. That’s all possible, but I think would result in a more finicky system (and require that the an inbox extension hold private keys for each inbox it served).