An agentic browser looks like a person in a report because it is a genuine browser engine. Two mechanisms answer the question of who is actually asking, and they cost very different things to run. One is a signature the agent brings along; this rebuilds the exact bytes that were signed, checks the key thumbprint against the keyid and verifies the signature. The other is a list of addresses the operator publishes; this counts what such a list covers and tests whether an address falls inside it.
Everything runs in the browser; no header, key or address is transmitted or stored. The example carries fixed timestamps so its signature stays verifiable - which is why it also reports as expired. That split is the useful part: cryptographically sound and currently valid are two separate findings.