A third party saying your Web Bot Auth setup works. Send {"url": "https://your-origin.example"} (your origin or your /.well-known/http-message-signatures-directory URL). scvd.store fetches the directory once and signs the readout: reachable, right media type, well-formed Ed25519 keys, proof-of-possession checked against the keys you list. You get back one JSON object: the signed card, its evidence hash bound into a certificate, the public key, and a verify_url served forever. Not an identity check and not an endorsement: it says your published half is in order at one moment.