and virtually every feed request on a thread is gonna include the user's npub because they want to read their own posts in the thread

lol, i doubt the heuristics required to positively identify the npub used by a client not authing would barely fill a screen