@charlag Thanks for the tip! Pinafore does "just work" and seems to get around CORS.
The way it works is by using the Mastodon API (https://github.com/nolanlawson/pinafore/blob/23287c6dcdb6bcdb18760c87bc4d98e1d9ca20cf/docs/Admin-Guide.md), which is set to allow CORS by default. It does not fetch content from the id of the content.
For GeoPub this is not a real solution as we would have to distinguish between content from Mastodon and the rest of the Internet.
This is a tiny, friendly fedi server!