An incomplete sketch of a browser plugin/feature that would allow posts to be signed from an anonymous source. (hiding your IP isn't addressed; use something like Tor)

* Blocks of text that start and end with magic numbers are signed in-band in the style of "gpg --clearsign".

* The pubkey pair is automagically created on first use.

For legacy support with existing infrastructure (such as HN):

* When you submit a form with a <textarea>, the plugin provides a UI to sign the contents before submitting the form.

* When browsing a page that contains magic number wrapped text, the text is automagically verified and the key pinned.

* The structure of the signed text should allow the plugin to hide the magic numbers, signature, etc, so the text looks normal.

However, newer software would have other options:

* Define a mapping between the in-band data and a tag structure that holds the same data. This needs to be strictly defined, so it is possible to remove the tag structure and verify the original signed text. This gives full presentation control back to the website, while allowing individual posts on the page to be verified.

The big problem - as usual - is key distribution. In the latter case where it is easy to hide metadata with CSS, the public key can simply be included with the post. Unfortunately, in the legacy case I don't think there's a good way to include two pages of public key in each "--clearsign"d post.