Cryptographically signed agent card

              DOMAIN=https://your-domain.example
curl -sS "$DOMAIN/.well-known/agent-card.json" | jq -r '.signatures[0].protected' | python3 -c "import sys,base64,json;p=sys.stdin.read().strip();p+='='*(-len(p)%4);print(json.dumps(json.loads(base64.urlsafe_b64decode(p)),indent=2))"
            

              // npm i jose canonicalize  ->  node sign-agent-card.mjs
import { readFileSync, writeFileSync } from 'node:fs';
import canonicalize from 'canonicalize';
import { CompactSign, exportJWK, generateKeyPair } from 'jose';

const card = JSON.parse(readFileSync('agent-card.json', 'utf8'));
const { privateKey, publicKey } = await generateKeyPair('ES256');
const { signatures, ...payload } = card;   // A2A v1.0 excludes signatures
const canonical = canonicalize(payload);   // RFC 8785 canonical JSON

const jws = await new CompactSign(new TextEncoder().encode(canonical))
  .setProtectedHeader({
    alg: 'ES256', typ: 'JOSE', kid: 'key-1',
    jku: 'https://your-domain.example/.well-known/jwks.json'
  })
  .sign(privateKey);

const [protectedHeader, signature] = jws.split('.');
const signed = { ...card, signatures: [{ protected: protectedHeader, signature }] };
writeFileSync('agent-card.signed.json', JSON.stringify(signed, null, 2));
const jwk = { ...(await exportJWK(publicKey)), kid: 'key-1', use: 'sig', alg: 'ES256' };
writeFileSync('jwks.json', JSON.stringify({ keys: [jwk] }, null, 2));