Thanks, Florian.
I'd considered this, but mistakenly thought that Bob's Blossom server needed auth from Alice (the blob owner) to accept the mirror. So Alice had to pre-sign the auth and embed it in the announcement for Bob's daemon to extract and pass along.
Revised to incorporate.
https://gist.github.com/shawnyeager/decd99be27eb052b68f0586d36038404?permalink_comment_id=5998822#gistcomment-5998822
