If a metadata value is an account handle, it's also verified using webfinger.

html.c

@@ -1077,10 +1077,17 @@ static xs_html *html_user_body(snac *user, int read_only)
             while (xs_dict_next(metadata, &k, &v, &c)) {
                 xs_html *value;
 
-                if (xs_startswith(v, "https:/") || xs_startswith(v, "http:/")) {
+                if (xs_startswith(v, "https:/") || xs_startswith(v, "http:/") || *v == '@') {
                     /* is this link validated? */
                     xs *verified_link = NULL;
                     const xs_number *val_time = xs_dict_get(val_links, v);
+                    const char *url = NULL;
+
+                    if (xs_is_string(val_time)) {
+                        /* resolve again, as it may be an account handle */
+                        url = val_time;
+                        val_time = xs_dict_get(val_links, val_time);
+                    }
 
                     if (xs_type(val_time) == XSTYPE_NUMBER) {
                         time_t t = xs_number_get(val_time);
@@ -1098,13 +1105,13 @@ static xs_html *html_user_body(snac *user, int read_only)
                             xs_html_tag("a",
                                 xs_html_attr("rel", "me"),
                                 xs_html_attr("target", "_blank"),
-                                xs_html_attr("href", v),
+                                xs_html_attr("href", url ? url : v),
                                 xs_html_text(v)));
                     }
                     else {
                         value = xs_html_tag("a",
                             xs_html_attr("rel", "me"),
-                            xs_html_attr("href", v),
+                            xs_html_attr("href", url ? url : v),
                             xs_html_text(v));
                     }
                 }

utils.c

@@ -488,6 +488,18 @@ void verify_links(snac *user)
 
     int c = 0;
     while (metadata && xs_dict_next(metadata, &k, &v, &c)) {
+        xs *wfinger = NULL;
+        const char *ov = NULL;
+
+        /* is it an account handle? */
+        if (*v == '@' && strchr(v + 1, '@')) {
+            /* resolve it via webfinger */
+            if (valid_status(webfinger_request(v, &wfinger, NULL)) && xs_is_string(wfinger)) {
+                ov = v;
+                v = wfinger;
+            }
+        }
+
         /* not an https link? skip */
         if (!xs_startswith(v, "https:/" "/"))
             continue;
@@ -563,6 +575,10 @@ void verify_links(snac *user)
 
                     user->links = xs_dict_set(user->links, v, verified_time);
 
+                    /* also add the original value if it was 'resolved' */
+                    if (xs_is_string(ov))
+                        user->links = xs_dict_set(user->links, ov, v);
+
                     vfied = 1;
                 }
                 else