RFC 9421 describes HTTP Message Signatures for creating, encoding, and verifying digital signatures over HTTP message components.
Message Signatures ensure selected parts of HTTP requests arrive unmodified, even through proxies, load balancers, or CDNs.
curl now experimentally supports HTTP Message Signatures with four new command-line options: --httpsig-algo, --httpsig-key, --httpsig-keyid, and --httpsig-headers.
The default signing algorithm is ed25519, with hmac-sha256 also supported.
Corresponding libcurl options (e.g., CURLOPT_HTTPSIG_ALGORITHM) are available for developers.
This feature is marked experimental and requires explicit build enabling; backward compatibility is not guaranteed.
The feature will ship in curl 8.22.0, contributed by Sameeh Jubran.