Web Bot Auth key directory

What the scanner requests

• /.well-known/http-message-signatures-directory

What is measured

The scanner issues GET https://<domain>/.well-known/http-message-signatures-directory and expects HTTP 200 with a JWK Set: a top-level keys array in which at least one entry is a usable Ed25519 verification key (kty "OKP", crv "Ed25519", a base64url 32-byte x, and a kid) that RFC 9421 Signature and Signature-Input verification can resolve. It passes when such a key is published, returns partial when the endpoint answers 200 with parseable JSON but no usable Ed25519 key (empty keys array, missing x, wrong crv, or an RSA-only set), and fails on a non-200, an HTML body or unparseable JSON.

Reproduce it yourself

You do not have to take our word for any of this. Run the same measurement against your own domain:

              DOMAIN="example.com"
curl -sSL -o /tmp/wba.json -w 'HTTP %{http_code} %{content_type}\n' "https://$DOMAIN/.well-known/http-message-signatures-directory"; grep -Eo '"(kid|kty|crv|x)"[[:space:]]*:[[:space:]]*"[^"]*"' /tmp/wba.json | sort -u
            

The fix

This is the artifact to ship. It is the complete change, not a description of one.

              {
  "keys": [
    {
      "kty": "OKP",
      "crv": "Ed25519",
      "x": "K6zqFKAe5fHfdzecJiq7nnGe0teq-_bhC1eP_fGo5bc",
      "kid": "2026-10-primary",
      "use": "sig",
      "alg": "Ed25519"
    }
  ]
}
            

Standards referenced

• RFC 9421

Related checks