The agent identity problem nobody is talking about yet

Genuine question I've been working through. Right now agent-to-agent auth is mostly API keys, OAuth, maybe mTLS. That works when agents operate within one platform. But the industry is heading toward autonomous agents crossing ecosystem boundaries. The A2A protocol just moved to Linux Foundation governance. NIST launched the AI Agent Standards Initiative . CSA published their Agentic Trust Framework . The gap I keep running into: existing auth verifies the client application , not the agent itself . An API key proves "this request came from a valid app." It doesn't answer "is this agent behaving normally" or "has the data it's carrying been tampered with." For the current generation of agents this isn't a crisis. OAuth and API keys are fine. But as agents get more autonomous and start interacting across different platforms without human oversight, the auth model breaks down. I've been prototyping what a verification layer might look like. Agent identity: Ed25519 challenge-response Beha