Justin Cormack: @janl @BarnabyWalters sure, it needs extending but I think http headers are the right place for this.

@justincormack @janl possibly, human-visible links/keys less likely to go out of date, also better BC as easier for people with dumb browsers to manually verify than invisible header info

updated: