[vidarh]

How transfer of accounts happens isn't part of the ActivityPub protocol at all - it was added last year to Mastodon just using ActivityPub as a transport.

A big improvement is possible "just" by making instances revalidate the URI against webfinger regularly (you'd still need to plan ahead for that, but it'd enable "stable" usernames) and secondly by allowing for a key pair to let users sign messages to make claims about ownership and which account is current. That would make it possible to enable fully unilateral moves.

Neither would require any changes to ActivityPub.