Co-signed DAG attestation is the only design that survives child-key compromise in cross-deployer agent delegation

arXiv·medium signalXBlueskyLinkedInCopy link

After an incident a verifier needs two answers, which deployer released the reported bytes and whether each cross-deployer edge was authorized, and credentials answer neither. The authors compare a signed linked list, a Merkle chain and a co-signed DAG under one threat model: the single-signer designs permit an unauthorized parent binding once a child key is compromised, while the co-signed DAG rejects it because the parent must authorize the edge. Ancestry-only checks run 24.3 to 499.2 microseconds per hop on an M1 Pro; a live workflow where a parent discovers a child A2A Agent Card and the child calls an MCP tool passed all 30 signed-DAG tasks at 813.1ms mean latency versus 770.8ms without evidence, and a three-AZ AWS deployment verified all 1,000 valid paths.