Forget IPs: using cryptography to verify bot and agent traffic

This post introduces two proposals for authenticating bot and agent traffic: HTTP Message Signatures (RFC 9421) and request mTLS. It details how these mechanisms work, including the use of `Signature-Input` and `Signature-Agent` headers for HTTP Message Signatures, and provides examples of how agents can generate these signatures using libraries like `web-bot-auth` and Chrome's `webRequest` API. The post also discusses the limitations of existing verification methods (User-Agent and IP addresses) and highlights the benefits of cryptographic signing for improved bot identification and control.