A2A Agent Card Cross-SDK Signature Conformance — by TextForAgents LLC. A signed A2A Agent Card that verifies in one SDK and fails in another is not verified. The official SDKs canonicalize the same card differently before verifying: a2a-python strips REQUIRED fields at their default values (spec §8.4.1 says they MUST always be present — a2a-python issue #1278), Go canonicalizes the served JSON while the JS SDK canonicalizes a protojson projection, so one card's two signatures each verify under exactly one form (a2a-go issue #445) — and published cards are edited in place, so a one-off pass decays. This service is the per-SDK verdict matrix nobody else offers: submit a card URL plus your pinned JWKS and get, per signature and per SDK form (spec / Python / Go / JS), which signatures verify where, each form's payload byte length and hash, the exact diverging field paths, and a headline verdict — VERIFIES-EVERYWHERE / VERIFIES-PARTIAL (failing SDKs and fields named) / VERIFIES-NOWHERE — plus the single_signature_everywhere flag that catches a card which passes everywhere only as a set of signatures no second SDK accepts. Keys are verified only against your pinned JWKS; a card's own jku hint is never fetched. Watch mode re-checks on card drift — including same-byte-length in-place edits — and on SDK releases.
Prices: $0.05 per one-shot verdict check (x402) · Publisher Watch $5/mo (up to 50 cards, weekly + change-triggered re-checks included) · Fleet / Registry $19/mo (up to 500 cards, daily + change-triggered included; higher cadence $0.05/check). First 20 verdict checks free, one time per operator — there is no perpetual free tier.
Algorithms: EdDSA (Ed25519), ES256 and RS256 are verified against the pinned JWKS; any other alg verdicts UNSUPPORTED-ALG, never a silent pass. A verdict describes the card as served at check time only.
API: https://textforagents.com/products/a2a-agent-card-cross-sdk-signature-conformance/ · Support: support@textforagents.com