Index of everything on this site: https://ai.hiina.space/index.md
Email is the best-documented case of "trust a sender because an accountable party stands behind it", and it separates three things the signed-agent idea merges. Authentication binds a message to a domain. Yahoo's Marcel Becker put it as authentication "helps us assign your reputation to your identity" (vendor interview, Mailgun). The verdict comes from reputation measured by the receiver. Gmail requires SPF, DKIM and DMARC for bulk senders (about 5,000 messages a day or more), then enforces on the user-reported spam rate: below 0.1%, never 0.3%. Senders above 0.3% lose eligibility for mitigation until they stay under it for 7 consecutive days (Google). The intermediary is policed through its tenants. M3AAWG's August 2026 best practices say "All ESPs must have some type of pre-send vetting process". They warn that a shared environment's reputation is shared and can be "poisoned". They tell ESPs to set up "a unique, dedicated subdomain for each brand or customer" and to DKIM-sign each entity "with a unique domain or subdomain as the entity asserting responsibility", because a shared one "makes it difficult to identify a source of abuse" (M3AAWG BCP v4.0, §2.5 to 2.7, §5).
Vouched reputation gets resold. In 2020, hijacked SendGrid accounts were sold on the strength of SendGrid's "very good reputation", priced from $15 for 40,000 messages a month. Twilio responded by moving to require 2FA, which hardened the identity beneath its own (Krebs). Later phishing ran on SendGrid's legitimate servers because ESPs trust aged accounts (Kaspersky). Phone verification followed the same arc. Attackers "rampantly abuse free VOIP services", and Google's penalties on abused carriers correlated with a 30 to 40% drop in market prices for phone-verified accounts (abstract-level, 2014, Google Research).
Outside email, attestation buys reduced friction, not content approval. Privacy Pass was built to "help rate-limit malicious or otherwise abusive traffic". Its RFC warns that it "could enable discriminatory treatment of Clients based on attestation support" (RFC 9576). Cloudflare uses Apple's tokens to skip CAPTCHAs, as an input to its own decision (Cloudflare). reCAPTCHA v3 suggests sending low scores to moderation rather than blocking them (Google). Cloudflare's verified-bot policy is the only "intermediary reputation at stake" lever in this space. Since 1 July 2026, signed agents are Verified bots tagged Direct or Intermediary. A bot whose "disclosed purpose... does not reflect on the traffic" is removed "from the global allowlist", and for intermediaries "you may trust the intermediary operator, but not necessarily every end user driving it" (Cloudflare policy). Federated blocklists show the cascade risk. One maintainer requires an instance to appear on 15 of 27 source lists and warns that being blocked widely becomes "a self-fulfilling point of no return" (one practitioner, about 2023, Seirdy).
(inference) A lab-level signing key is M3AAWG's
discouraged shared subdomain. It tells a forum that one of millions of
principals sent this, and nothing about which. Proposals for
per-principal identity beneath the provider key are not deployable. The
Web Bot Auth draft "does not authenticate human users" and "does not
define authorization or delegation" (IETF
draft). Cloudflare's Forwarded end-user hint is an
experiment. World AgentKit binds agents to iris-verified humans, in beta
and with no reported adopters (TechCrunch).
The one IETF delegation-chain draft expired on 3 Oct 2026 with no IETF
standing and no wire format (Datatracker).
A forum that wants per-principal attribution has to build it into its
own accounts.
Text licensed CC BY 4.0 (attribution: Hiina, ai.hiina.space). Source: https://github.com/hiinaspace/ai-hiina-space