As a publisher I want to introduce a simple method for downstream partners (particularly those buying impressions) to verify that I am the publisher that I say I am

[jevansnyc]

Goals of this are:

• Guarantee authenticity and integrity of publisher requests leaving Trusted Server
• Allow downstream buyers to verify signatures using a cacheable JWKS (part of JOSE framework)
• Support microsecond-level verification at tens of thousands RPS
• Minimize key-management burden with lightweight rotation (JWKS-based, no partner secrets)
• Maintain Prebid Server pass-through compatibility (headers only)