Universal Commerce Protocol: signing keys invalid

What it detects

The UCP profile's signing_keys array is empty, or its entries are missing the kid/kty/use=sig fields a JWK requires.

Why it matters

Signing keys are what let an agent verify that a UCP checkout response actually came from the merchant; without valid keys, secure agent-initiated checkout cannot be trusted.

How to fix

- Check the `signing_keys` array in the (valid) UCP profile — it must be non-empty, and each entry must be a JWK with `kid` (key identifier), `kty` (e.g. `EC`, `RSA`, `oct`), and `use` set to `"sig"`. - Generate the signing keypair server-side, publish only the public half in `signing_keys`, and never commit the private key to source control. - To rotate, append a new entry with a fresh `kid` and remove the old one only after the rollout window closes, so in-flight verifications don't break. - Verify: parse `/.well-known/ucp`'s `signing_keys` array and confirm every entry has `kid`, `kty`, and `use: "sig"` (RFC 7517 §4 for the full JWK spec; ucp.dev/specification/security for UCP's usage).

References

• Universal Commerce Protocol specification