[Web-bot-auth] Re: Call for adoption - HTTP Message Signatures for automated traffic

[Nick Mathews <[e-mail]>]

I support adoption.

The basis, briefly, from the verifier seat: we run a merchant-side
verifier for this protocol in production. We implemented -01 from the
published text the weekend it appeared, and the deployment divergences we
reported on 9 August became tracked issues, three of which -02 resolves.
That is working group process doing its job before the group formally
exists. The Appendix B test vectors we contributed were merged after
being independently validated against Cloudflare's implementation, so the
document carries multi-implementation evidence behind its examples
already.

As an implementer, the property I weigh most is that we could build from
the text alone, with no private context, and interoperate with
deployments we do not control. Both revisions cleared that bar for us.
The questions still open, redirect semantics for domain binding, alg in
the JWKS, migration guidance, are the kind a working group exists to
settle.

Nick Mathews
AVA Pay, Agentic Verification Architecture
On Aug 18, 2026 at 4:58 PM -0400, Gary Illyes <garyillyes=[e-mail]>, wrote:
> This is the most comprehensive, well-thought-out and robust solution I've seen for solving bot auth. Strongly support adoption by the wg
>
> On Tue, 18 Aug 2026 at 21:58, Rifaat Shekh-Yusef <[e-mail]> wrote:
> > All,
> >
> > This is an official call for adoption for the HTTP Message Signatures for automated traffic draft:
> > https://datatracker.ietf.org/doc/draft-meunier-webbotauth-httpsig-protocol/
> >
> > Please, reply on the mailing list, on whether you support or oppose the adoption of this document by Sep 1st.
> > Remember that the current version is a starting point for this work.
> >
> > Regards,
> >  Rifaat & David
> >
> >
> > _______________________________________________
> > Web-bot-auth mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> _______________________________________________
> Web-bot-auth mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]