HTTP Request Signatures, (Mon, Sep 8th)

This report notes the first appearance of HTTP Message Signatures headers (Signature-Input, Signature-Agent, Signature) in honeypot traffic and explains how RFC 9421 supports bot authentication by signing selected request components and publishing public keys via a well-known URL. It includes an example signed request and JWK response, and references integrations (e.g., Cloudflare, Zuplo) that can validate trusted bots and reduce impersonation.