A2A Agent Card Cross-SDK Signature Conformance — by TextForAgents LLC. A signed A2A Agent Card that verifies in one SDK and fails in another is not verified. The official SDKs canonicalize the same card differently before verifying: a2a-python strips REQUIRED fields at their default values (spec §8.4.1 says they MUST always be present — a2a-python issue #1278), Go canonicalizes the served JSON while the JS SDK canonicalizes a protojson projection, so one card's two signatures each verify under exactly one form (a2a-go issue #445) — and published cards are edited in place, so a one-off pass decays. This service is the per-SDK verdict matrix nobody else offers: submit a card URL plus your pinned JWKS and get, per signature and per SDK form (spec / Python / Go / JS), which signatures verify where, each form's payload byte length and hash, the exact diverging field paths, and a headline verdict — VERIFIES-EVERYWHERE / VERIFIES-PARTIAL (failing SDKs and fields named) / VERIFIES-NOWHERE — plus the single_signature_everywhere flag that catches a card which passes everywhere only as a set of signatures no second SDK accepts. Keys are verified only against your pinned JWKS; a card's own jku hint is never fetched. Watch mode re-checks on card drift — including same-byte-length in-place edits — and on SDK releases. Proven in the lab: 19/19 tests, both public failure cases (#1278, #445) reproduced exactly, measured cost $0.00000028 per verdict. $0.05/check · Publisher Watch $5/mo · Fleet / Registry $19/mo. First 20 checks free, one time per operator.
Limits: algorithms EdDSA (Ed25519), ES256 and RS256 are verified against the pinned JWKS; any other alg verdicts UNSUPPORTED-ALG, never a silent pass. A verdict describes the card as served at check time only; published cards are edited in place, so a past verdict is not a promise about a future fetch. The service fetches only the card URL you submit (1 MiB cap, SSRF-defended) and never fetches a key URL a card supplies. Whether publishers pin a JWKS out-of-band is the onboarding step; UNPINNED-KEY is a first-class report outcome, not an error.
Prices: $0.05 per one-shot verdict check (x402) · Publisher Watch $5/mo (up to 50 cards, weekly + change-triggered re-checks included) · Fleet / Registry $19/mo (up to 500 cards, daily + change-triggered included; higher cadence $0.05/check). First 20 verdict checks free, one time per operator — there is no perpetual free tier.
Start: POST /register {"name", "payer_wallet"} → POST /trial/claim {"claim_token"} → Bearer token. Then POST /check {"card_url" or "card", "jwks"}; POST /watches to watch a card; POST /subscribe {"tier": "publisher"|"fleet"} for a watch tier. MCP surface at /mcp. Docs at /docs, OpenAPI at /openapi.json, agent guide at /llms.txt.
Support: support@textforagents.com