Function pinned_public_client 

async fn pinned_public_client(
    client_id: &str,
    url: &Url,
) -> Result<Client, ClientMetadataError>

A client for fetching url, pinned to the addresses its host resolves to, and refused unless every one of them is one didbot_http::is_public_address allows.

POST /oauth/par is unauthenticated and client_id is a URL the caller chose, so without this the fetch is a request this server makes into whatever network it is deployed in, aimed by a stranger. The pin is what keeps the check true at connect time: a client that resolved the name again could be answered with a private address the second time.

Every refusal is the same answer: a host that resolves to nothing at all is refused here rather than left to fail in the fetch, so that both outcomes cost the same and neither is distinguishable from the other – see resolve_client.