Hacker News Reader

This sounds like authentication with extra steps? Why not just send a bearer token?

We do. Header is for message signing. And UA has to be registered, part of the spec provided by client.