[extraduder_ire]

You can authenticate a handle via a file in ./well-known/ at the domain too, which is how bluesky does it for their default handles.