CAPTCHA was an identity system, and it returned one bit: human, or not. For twenty years that was enough, because the only thing a site needed to know about a visitor was whether there was a person behind them. That question has stopped being the useful one. The web is replacing "prove you're human" with "prove who you work for," and the mechanism is a signature on the request tied to a key its operator publishes. The cryptography involved is small and mostly settled. Everything that will decide whether this works is key management and registry governance, which is a much less interesting problem and a much harder one.
One bit is the wrong shape of answer
On September 15, 2026, Cloudflare starts blocking training and agent crawlers by default on pages carrying ads, while search crawlers stay allowed. A policy like that only means anything if the edge can tell one machine from another. "Automated" is not a useful category anymore when the automated traffic includes a search crawler you want, a training crawler you may want paid for, an agent buying something on a customer's behalf, and a scraper farm rebuilding your catalogue. Those four get four different answers, and no amount of confidence about the human/not-human bit helps you pick.
The commercial half of this is newer and matters more. For most of the web's history, a non-human visitor was a cost: bandwidth spent, nothing earned. An agent holding a wallet inverts that. Blocking it at the door is lost revenue, so the reflex to refuse everything that fails a humanity check became the wrong business decision at roughly the same moment it became unenforceable. You cannot bill a client you cannot name.
The puzzle didn't die. It went invisible.
Here is the part most writing on this gets wrong, and it cuts against the argument I am making, so it goes early.
Image CAPTCHAs are finished as a defence. What replaced them is not weaker: anti-bot systems moved to behavioural and device-level detection, scoring device entropy, input cadence, timing irregularities, TLS and network consistency, and increasingly a proof-of-work challenge the client never sees. General-purpose agents driving a browser do trip these, routinely, because they lack fine control over the low-level signals being measured. Headlines announcing that AI has solved CAPTCHA are describing puzzle-solving accuracy, which was never the hard part of the system.
So behavioural detection works. It just cannot answer the question anyone now wants answered. It produces a probability that a request belongs to a broad category, and it degrades exactly as well-behaved agent traffic grows, because a legitimate agent looks like a bot by construction: no mouse, no dwell time, no reason to render a page it is only parsing. You can fingerprint your way to "this is probably automated." There is no sequence of fingerprints that gets you to "this is Perplexity's crawler and Perplexity will answer for it."
That last part requires someone to make a claim and hold a key.
The handshake
The protocol here is Web Bot Auth, and its mechanism is deliberately small. An operator generates an asymmetric keypair and publishes the public half as a JSON Web Key Set at a discoverable HTTPS endpoint. Outbound requests carry Signature and Signature-Input, and normally a Signature-Agent header pointing at an HTTPS URL that both identifies the operator and tells the server where to find the keys. The signing itself is RFC 9421 HTTP Message Signatures, a general-purpose standard that predates this use of it, with ed25519 as the algorithm in practice.
Cloudflare folded message signatures into its Verified Bots program on July 1, 2025, verifying at the edge and bounding replay with signature expiry. The current specification, draft-meunier-webbotauth-httpsig-protocol, was revised on August 6, 2026 by Thibault Meunier of Cloudflare and Sandor Major of Google, and adds two discovery mechanisms alongside the well-known directory. A companion draft defines a registry and a signature agent card, which is where an operator declares what it is and who runs it.
Notice what the signature actually proves: that whoever made this request holds the private key matching a public key published at that URL. That is all. It says nothing about intent, nothing about behaviour, and nothing about whether the operator deserves anything.
What it replaces was worse than you remember
Before this, verifying a crawler meant checking its IP against a published range and reading its user-agent string. Cloudflare's own description of why that had to change is blunt: address ranges get shared with other services and change over time, and user-agent headers are trivially spoofable. Anyone who has maintained an allowlist knows the failure mode. A provider rotates a block, your rules silently start refusing a partner's traffic, and you find out from a support ticket three weeks later.
A key you can rotate while keeping the old one published, at a URL that is itself the identity, fixes a real operational problem. The protocol draft handles rotation exactly that way: new keys appear alongside old ones at the same location, so identity survives the change.
Signatures don't grant trust. Issuers do.
Now the part that decides whether any of this holds up, and it has nothing to do with cryptography.
A signature system is only as good as the answer to four questions, none of which the mathematics addresses. Who admits an operator to the registry, and on what evidence. How a compromised key is revoked, and how long that revocation takes to reach every edge that has cached the directory. What an operator forfeits by misbehaving after it has been admitted. And what happens to an operator that is refused.
These are the questions that make PKI hard everywhere it exists, and the web has run this experiment before. Certificate authorities took roughly two decades, several public failures, and eventually Certificate Transparency to reach something trustworthy, and that system had the advantage of a well-defined claim to certify: control of a domain name. "This agent is a legitimate commercial crawler that will respect the terms it agreed to" is a much softer claim, verified by a much less mature process.
The governance position is worth stating plainly. The IETF chartered a Web Bot Auth working group in October 2025, co-chaired from outside Cloudflare, and its milestones include a best-practice document on key management and deployment. The two specifications above are not yet adopted working-group documents — they remain individual submissions, and the earlier architecture draft was revised and then superseded rather than advanced. So the standard has a neutral venue. The registry does not. The one that matters in production, the one your traffic is actually filtered against today, is operated by a CDN. Cloudflare has been a good steward here and did the standards work in the open, which is more than the incumbent alternative offered. It is still one company holding the pen on who counts as a legitimate machine, and that is a load-bearing detail for anyone building an agent that needs to be let in.
Compare the trajectory of x402 moving to the Linux Foundation in April 2026. Payment plumbing got a neutral body and, with it, neutral rules for who participates. Identity plumbing has the neutral body and not the neutral registry.
The other fork
There is a symmetric answer to the same problem: instead of naming the machine, certify the human. Proof of personhood issues a one-per-person credential, usually without revealing which person, so a service can enforce scarcity without collecting identity. World is the largest deployment, with more than 18 million people verified across 160 countries via its iris-scanning hardware. It has also been banned or suspended in Kenya, Indonesia, Hong Kong, and Spain, and Brazil's data-protection authority suspended payment for iris enrolment, which tells you how much appetite regulators have for biometric enrolment as internet infrastructure.
My read is that these two systems are answering different questions and should not be forced to compete. Proof of personhood is the right tool where a human's scarcity is the asset: one vote, one allocation, one account. It is the wrong tool for an origin server deciding whether to serve a page, because the server does not need to know that a human exists somewhere upstream. It needs to know who is accountable for this request.
Between them sits an option that deserves more attention than it gets. Privacy Pass (RFC 9576 for the architecture, RFC 9577 for the HTTP authentication scheme, RFC 9578 for issuance) lets a client present an anonymous token proving it earned access, without identifying itself at all, and a rate-limited issuance variant is in draft at the IETF. It answers "are you entitled" while refusing to answer "who are you." For a lot of what CAPTCHA was actually deployed to stop, that is the honest requirement.
What to build against
If you run an origin, the thing to internalise is that your bot policy is becoming an access-control list keyed on operator identity, and it will need the same care as any other ACL: an owner, a review cadence, and a plan for the day a key you trust is revoked.
If you build agents, your crawler now has a cryptographic identity with a reputation attached to it, and the private key behind that identity is production key material. Treat it accordingly. The teams that get burned first will be the ones that ship a signing key in an environment variable, discover it leaked, and learn what revocation latency means with their traffic blocked.
Every request on the machine web is converging on carrying two things: a signature saying who is asking, and a payment saying what it is worth. The payment half has a neutral home. The identity half has a neutral standards venue and no neutral registry, and until it has both, the most important question about agent identity is not how the signature works. It is who gets to say no.
AKENA is a blockchain engineering studio. We build the infrastructure AI agents run on: agent-facing RPC and MCP endpoints, on-chain data pipelines, and the key management, identity, and metering layers that sit in front of them. If you're working out how to let the right machines in, we should talk.