email-verification: conformance work needed for signature-key -07 / httpsig 2.0 #66

The draft-hardt-httpbis-signature-key draft is being revised, and @hellocoop/httpsig 2.0 (#65) tracks -07. It is not wire compatible with 1.x in either direction, and the protocol has no version negotiation, so both ends of a deployment must move together.

@hellocoop/email-verification needs a conformance pass before it can move.

It is currently not being exercised against 2.0

email-verification/node_modules/@hellocoop/httpsig is a real directory pinned at the published 1.7.1, not a symlink to the workspace package. It shadows the workspace symlink at packages-js/node_modules, so npm test --workspace=email-verification and tsc --noEmit both resolve 1.7.1 regardless of what the workspace httpsig contains.

This means the suite currently passes against 2.0 only because it never sees it. Worth fixing first, or the rest of this work will look done when it is not.

Known breakage

strictAAuth is removed in 2.0. src/issuance/verify-request.ts:63 passes it:

const verifyOptions: VerifyOptions = {
    maxClockSkew,
    strictAAuth: true,
}

This is a compile error against 2.x — the option is gone because covering signature-key is a specification requirement rather than a profile choice and can no longer be disabled. The fix is to delete the line; the behaviour it requested is now the only behaviour. The comment at line 85 referring to strictAAuth=true needs updating too.

The dependency range is ^1.7.0, which will not resolve 2.x.

Protocol-level change, not just a dependency bump

EVP conveys the browser-generated public key with the hwk scheme so the issuer can bind it into the verification token. Under -07:

• A conveyed JWK must carry a fully-specified alg (Ed25519, not EdDSA). crypto.subtle.exportKey("jwk", ...) does not set alg, so whatever generates the browser key must stamp it.
• The hwk header gains a required alg parameter: sig=hwk;alg="Ed25519";kty="OKP";crv="Ed25519";x="...". In -06 that parameter was forbidden, so this is a two-way break on the wire.
• A kid parameter on hwk is now rejected.

That affects the EVP wire format and anything already deployed against it, not only this package. Worth deciding deliberately rather than inheriting it from a version bump.

References

• Draft changes: BCP 14 audit of every SHOULD, and post-quantum rationale corrections dickhardt/signature-key#24
• Library changes and full migration notes: httpsig 2.0: track draft-hardt-httpbis-signature-key-07 #65 and httpsig/MIGRATING-2.0.md

The draft is not adopted and -07 is not final, so there is no urgency to move — the point is to know what moving costs before 2.0 leaves prerelease.

Revision correction: this work lands in -08, not -07. -07 was published to the datatracker on 2026-07-05 and was editorial (an Introduction paragraph citing AAuth and Email Verification). The hwk alg parameter was forbidden in -06 and -07 and becomes required in -08, so the break is -07 → -08. References to -07 below should be read as -08.