Mastodon has a cute way to validate sites as being yours. If you put your masto address in the text of the site that's good enough. But it has to be HTTPS. Oh well. I think they get most things right at Masto, but the trying to force people to adopt HTTPS is selling out to Google and their thirst to own the web, which is imho not theirs to own.