Re: Call for adoption: draft-hardt-httpbis-signature-key-08 (Ends 2026-09-07)

As an author I support adoption

On Mon, Aug 17, 2026 at 5:01 AM Tommy Pauly <tpauly@apple.com> wrote:

> Hello HTTP WG,
>
> At IETF 126, we discussed draft-hardt-httpbis-signature-key and we heard a
> fair bit of interest in this work. We’ve previously issued an adoption call
> earlier in the year, but we’ve had more discussion since then. We’d like to
> get input from the group on whether or not you think we should adopt this
> work. Please email the list with your input by September 7!
>
> Best,
> Tommy
>
>
> > On Aug 16, 2026, at 8:54 PM, Tommy Pauly via Datatracker <
> noreply@ietf.org> wrote:
> >
> > This message starts a httpbis WG Call for Adoption of:
> > draft-hardt-httpbis-signature-key-08
> >
> > This Working Group Call for Adoption ends on 2026-09-07
> >
> > Abstract:
> >   This document defines five HTTP header fields for use with HTTP
> >   Message Signatures as defined in RFC 9421.  The Signature-Key request
> >   header distributes public keys used to verify signatures, with eight
> >   initial key distribution schemes: pseudonymous inline keys (hwk),
> >   self-issued key delegation via JWK Thumbprint JWTs (jkt-jwt),
> >   identified signers with JWKS URI discovery (jwks_uri), direct JWKS
> >   fetch (jwks), JWT-based delegation (jwt), self-issued JWTs (self-
> >   jwt), X.509 certificate chains (x509), and references to previously
> >   cached assertions (cached).  The Accept-Signature-Scheme and Accept-
> >   Signature-Alg response headers state the schemes and algorithms a
> >   server accepts, so a client can select both before it signs.  The
> >   Signature-Error response header provides structured error information
> >   when signature verification fails, and the Signature-Key-Cache
> >   response header issues a cache identifier by which a caller can
> >   reference a previously presented assertion instead of resending it.
> >   Together, these mechanisms enable flexible trust models ranging from
> >   privacy-preserving pseudonymous verification to horizontally-scalable
> >   delegated authentication and PKI-based identity chains.
> >
> > Please reply to this message and indicate whether or not you support
> adoption
> > of this Internet-Draft by the httpbis WG. Comments to explain your
> preference
> > are greatly appreciated. Please reply to all recipients of this message
> and
> > include this message in your response.
> >
> > Authors, and WG participants in general, are reminded of the Intellectual
> > Property Rights (IPR) disclosure obligations described in BCP 79 [2].
> > Appropriate IPR disclosures required for full conformance with the
> provisions
> > of BCP 78 [1] and BCP 79 [2] must be filed, if you are aware of any.
> > Sanctions available for application to violators of IETF IPR Policy can
> be
> > found at [3].
> >
> > Thank you.
> > [1] https://datatracker.ietf.org/doc/bcp78/
> > [2] https://datatracker.ietf.org/doc/bcp79/
> > [3] https://datatracker.ietf.org/doc/rfc6701/
> >
> > The IETF datatracker status page for this Internet-Draft is:
> > https://datatracker.ietf.org/doc/draft-hardt-httpbis-signature-key/
> >
> > There is also an HTML version available at:
> >
> https://www.ietf.org/archive/id/draft-hardt-httpbis-signature-key-08.html
> >
> > A diff from the previous version is available at:
> >
> https://author-tools.ietf.org/iddiff?url2=draft-hardt-httpbis-signature-key-08
>
>