Good news - this part of the spec is literally an additional header linking to key data: https://datatracker.ietf.org/doc/html/draft-meunier-http-mes... .

Cloudflare is doing this registration as part of their "verified" program, which gives special treatment to bots/agents who go through the process. That's a Cloudflare-specific feature, not part of the spec.

Nice catch. Even if we like the standard, the specific implementation can have problems. MSIE, extend and embrace are similar examples.