Key type is OKP

What this check verifies

This check reads every key in the directory and confirms each one has kty set to OKP. A key with a different kty raises a warning.

OKP stands for Octet Key Pair, the JSON Web Key type for Edwards-curve keys, defined in RFC 8037. Ed25519 keys are OKP keys:

{ "kty": "OKP", "crv": "Ed25519", "x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo", "kid": "..." }

Why a warning and not a failure: the directory draft restricts key algorithms to the IANA HTTP Signature Algorithms registry, which includes RSA-PSS and ECDSA alongside Ed25519, and the architecture draft even ships RSA-PSS test vectors. So a non-OKP key is not a spec violation. In the deployed ecosystem, though, every known signer (OpenAI, Google, AWS, the reference libraries) uses Ed25519, and Ed25519 is the only algorithm this checker can cryptographically verify today. The warning states exactly that.

This check no longer makes the directory INVALID. A directory whose keys are RSA is spec-legal; it is just not verifiable by this tool yet, and unlikely to be verifiable by most deployed verifiers.

Why it matters

The kty member tells a verifier how to interpret the rest of the key. A verifier built for the Ed25519 baseline cannot use an RSA or EC key, so signatures made with such a key will not be verifiable by most of today’s Web Bot Auth infrastructure even though they are within the letter of the draft. Until other algorithms see real deployment, publishing non-Ed25519 keys mostly costs you interoperability.

How to fix it

This is advisory; for maximum interoperability, publish Ed25519 keys:

{ "kty": "OKP", "crv": "Ed25519", "x": "...", "kid": "..." }

Generate an Ed25519 keypair and export its public JWK, which will carry kty: "OKP". If you intentionally publish keys for another registered algorithm, expect most verifiers (including this checker) to be unable to verify signatures made with them today.

References

• RFC 8037 defines the OKP key type and Ed25519 for JOSE.
• RFC 7517 defines the kty member of a JSON Web Key.
• The web-bot-auth directory draft restricts alg to the IANA HTTP Signature Algorithms registry (Ed25519 is one of several).
• How grading works explains how advisory warnings affect the score.