Sometimes Orion is unaware of all the information that will be part of AppActionMetadata, and it needs that information from trusted external sources. The problem is how does Orion trust/validate that the AppActionMetadata info that it got from external sources/actors is actually correct?

Problem Context

As mentioned in Joystream/youtube-synch#139, We want the channels/videos youtube attribution information to be part of AppActionMetadata and not the raw action (i.e. CreateVideo). We also discussed that Orion will be doing the signing (there is also an endpoint for that).
However, Orion is not aware of the video attribution (ytVideoId) information.
So Yt-synch backend need to send to send both VideoMetadata & ytVideoId. But the problem is that Orion does not really verify what it is signing or what actor is asking for a signature from it, so someone can create a video with the same fake ytVideoId (which is part of AppActionMetadata), and it won't be possible to distinguish a fake from a real one

There are two possible solutions I can think of:

1. Orion should authenticate YT-synch backend so that it can trust that the YT backend is sending the correct attribution information that Orion needs to sign.
2. Along with Orion, YT-synch infra also hosts the same signing private key; this way YT-synch infra can do the signing itself.