Research inquiry: browser-native HTTP Message Signatures beyond Signature-based Integrity

[Martin Tuhus]

Hello,

My name is Martin Tuhus, and I am preparing a scientific paper based on research conducted at the University of Oslo.

The paper examines web applications that use TLS-terminating intermediaries,
such as CDNs and WAFs. I developed and evaluated a prototype that uses HTTP
Message Signatures, Content-Digest, and selective field-level encryption to
protect communication beyond the TLS intermediary.

RFC 9421:
https://www.rfc-editor.org/rfc/rfc9421.html

RFC 9530:
https://www.rfc-editor.org/rfc/rfc9530.html

I am also aware of the Signature-based Integrity proposal, which applies a
profile of RFC 9421 to signed web resources:
https://github.com/WICG/signature-based-sri

My prototype currently relies on a Service Worker and an out-of-band verifier.
I am investigating whether the relevant functionality could instead be
integrated into browsers. In such a model, the browser could verify signed
responses before exposing them to the page, generate an origin-bound key for
signing selected requests, and retrieve the origin's verification key through
a trusted mechanism.

I would greatly appreciate your perspective on three questions:

1.  Is work involving RFC 9421 or RFC 9530 currently being considered in
      Chromium, beyond the Signature-based Integrity use case?
2.  Would native verification of signed origin responses and signing of
      selected outgoing requests be compatible with the browser's networking
      and security architecture?
3.  When implementing HTTP Message Signatures the browser needs a public key to check    the signatures. Do you have any thoughts on how the public key could securely be sent from the web application to the browser

Even a response of a few sentences would be highly valuable. With your
permission, I may quote or summarise the response in the paper. Please indicate
whether your response represents a personal technical opinion, a team
perspective, or an official project position.

The relevant section will be finalised on 5 August 2026, so a response before
that date would be greatly appreciated.

Best regards,

Martin Tuhus
University of Oslo
Martin...@gmail.com