On April 30, 2026, CISA, NSA and the Five Eyes published “Careful Adoption of Agentic AI Services.” Every requirement maps to something Rootz already runs — on both sides of every agent.
The guidance asks for message integrity between agents: cryptographic identity, short-lived credentials, zero trust, encrypted communications, attestation-backed tokens. That is exactly the Rootz primitive — signed, durable, verifiable messages — applied to how humans talk to AI (Proof of Origin) and how AI talks to services (Signed MCP).
| Five Eyes requires | Rootz implementation | Status |
|---|---|---|
| Cryptographically verified identity | Birth certificate on Polygon. secp256k1 ECDSA. TPM-bound keys. | Live |
| Short-lived credentials, JIT provisioned | Session tokens (5–60 min TTL). Desktop V6 issues and revokes. | Live |
| Zero trust between agents | Every MCP call policy-checked. No implicit trust from co-membership. | Live |
| Replace persistent API keys | Wallet-based OAuth (epistery challenge/sign/verify). No bearer tokens. | Live |
| Encrypt inter-agent communications | ECDH + AES-256-GCM. Post-quantum: ML-KEM-1024 + ML-DSA-65. | Live + PQ |
| Attestation-backed tokens | TPM-bound key derivation. Hardware root of trust. Desktop as HSM. | Live |
| Agent identity lifecycle | Provisioning at spawn, scope binding, revalidation, automatic revocation. | Live |
| Signed, fresh, context-bound tool messages (NSA MCP notice) | Signed MCP: every response + tool definition signed with nonce, bounded-window timestamp, and context binding. Anti tool-poisoning. | Live |
ed25519ecdsa-p256ml-dsa-65 · FIPS 204ML-KEM-1024 · FIPS 203RFC 8785 (JCS)DKIM-style discovery
The guidance says agents need cryptographic identity — but the common answer to “where does the root key live?” is “the infrastructure gives you one” (a SPIFFE issuer, cloud IAM, a vault). That recreates a central policy engine as a single point of failure.
Our answer: the key lives in the owner’s hardware (TPM). No central issuer, no infrastructure dependency. Sovereign — and the same root signs both the human’s prompt and the service’s response.
Signed MCP is live and checkable right now:
Open the Signed MCP page → ·
GET /sign-demo POST /verify
JWKS
Primary sources: Five Eyes guidance (CISA) · NSA MCP Security notice · Pope Leo XIV, Magnifica Humanitas