It should be a signature that is sent together with the ActivityPub Object. Yes, if the signature doesn’t match, the content, whether a post, comment, favorite, upvote, etc… should be dropped.
Here is the source code of the library that lemmy uses to handle incoming objects and you can see that it does a call to verify the signature of the actor:
Not that instance, but Lemmy is missing a lot of moderation and federation tools. Right now you only have sledgehammers to deal with tiny nails, in regards to tooling.