IETF: PQ issuer certs, agent capacity, moderator rules

IETF lists spent the day on post-quantum certificate compatibility, capacity controls for agent traffic, and a large fight over moderator procedures. New drafts also covered AI training signals, ACME workload identity, DKIM2 policy, early attestation, and DNS ANY.

Embedded alternate issuer certificates

A new LAMPS draft proposes embedding alternate post-quantum issuer certificates so legacy servers can be supported during the Web PKI post-quantum transition. The thread drew 17 messages from seven participants and stayed technical.

PACE capacity management for agents

An individual draft, PACE, proposes capacity budgets for agent platforms so abusive traffic does not produce shared-fate blocking. On web-bot-auth, 15 participants in 35 messages debated AI agent privacy against abuse controls.

Moderator team procedures

The IETF Moderator Team asked for community input on draft procedures. The mod-discuss thread, 146 messages from 25 participants, expanded into debate over holds on new participants, brigading, and risks to consensus.

AI training preference signals

An Anthropic-submitted draft, draft-kelley-aipref-training-preference-signal-00, proposes robots.txt signals for AI-training preferences. Working group chairs and other participants on ai-control debated scope, process, and acknowledgments.

ACME workload identity challenge

A new I-D, draft-rasmussen-acme-wif-00, proposes a wif-01 ACME challenge that uses platform OIDC tokens for workload certificates. Working group members discussed the identifier model and how the challenge relates to external account binding.

DKIM2 and DMARC sender policy

The IETF DKIM list discussed DKIM2 and DMARC policy alignment, including modification flags, amid security concerns over forwarding. The exchange ran to 56 messages from 15 participants.

Review of early-attestation binding analysis

A paper asked the Crypto Forum Research Group to review a formal analysis that claims vulnerabilities in two early-attestation IETF drafts. Reviewers contested the model's fidelity and EOL claims across 31 messages.

Stronger deprecation of DNS ANY

DNSOP discussed strengthening the deprecation of QTYPE=ANY beyond RFC 8482 to MUST NOT. Participants cited attack amplification and a lack of legitimate use.