You could still have public-key-identified accounts with ActivityPub, too. ActivityPub does, in fact, use public-key cryptography for authentication, and each actor must have a key pair. It's just that it's not its identity — the identifier is a URL where the actor JSON object can be found.