Independent verifier · foreign agents
The buyer agent runs, against agents found through public indexes, the same checks it runs on the seller before it buys: DNSSEC, the DNS-AID record, where the card is pointed from, DANE, the card and its digest, the endpoint, the record signature, an instance identity, the ANS registration, reachability. Here it does not stop at the first miss. What is shown is the buyer's opinion, read live from the buyer's host and signed by its instance key; this verifier renders it and does not vouch for it.