Mastodon's VerifyLinkService uses strict string comparison against account.url (which includes trailing slash from the AP actor's url field). The h-card self-link used SITE_URL without trailing slash, causing the comparison to fail silently.