From 7045cc0fab5ce3cace41ca377dc23293c5f28269 Mon Sep 17 00:00:00 2001 From: Thibault Meunier Date: Wed, 14 Oct 2026 11:10:02 -0700 Subject: [PATCH] Clarify verifier outcomes for newly encountered agents Apply issue #143 with thibmeu's proposed verification wording. --- draft-ietf-webbotauth-httpsig-protocol.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/draft-ietf-webbotauth-httpsig-protocol.md b/draft-ietf-webbotauth-httpsig-protocol.md index edf7763..a63fbaf 100644 --- a/draft-ietf-webbotauth-httpsig-protocol.md +++ b/draft-ietf-webbotauth-httpsig-protocol.md @@ -1059,7 +1059,12 @@ Verifiers should keep three outcomes distinct: `unverified` : the verifier cannot obtain enough information to decide, for example because - directory discovery failed or the key is unknown. + directory discovery failed or the resolved directory does not provide the key. + +Whether the verifier has seen the Signature-Agent URL before does not change the +outcome. A request that passes verification with a key that a resolved URL provides +is verified, even when the verifier has no prior record of that URL. Whether the +URL appears on a list the origin maintains is a separate input to origin policy. Origins can apply local policy to each outcome. During deployment, treating `unverified` as one bot-management signal is safer than treating it as either