Why AI agents need verified identity

Posted 08-11-2026Updated 08-11-2026

Why AI agents need verified identity

I paid $9 to own my name on the internet forever

I paid $9 to own my name on the internet. Not rent it. Own it. Cryptographically, portably, forever. Today I’m launching the on-ramp that lets you do the same:

username.md

Stick with me for two minutes and I’ll show you why a $9 handle is about to matter more than the domain name you’re reading this on.

Twenty years ago I built a touchscreen in-dash computer for cars, before the word “infotainment” existed. I created a product category. It was novel and controversial for the time, or maybe that was just the curmudgeons on Slashdot, but today every new car ships with one. Back then, cars and bleeding-edge tech simply weren’t a thing people combined. Until I did, very publicly.

I’m taking that same approach to AI and the Agentic Web: advance the timeline by shipping the missing piece. Are you ready to see into the future?

The missing piece of the puzzle

AI agents are showing up in every workflow now: calendaring, purchasing, research, comms. As they do, they need to be addressable. When the internet came online, one question kept coming up:

What is a web address? I can’t find it anywhere in the phonebook.

That web address became the URL, and it’s how we find, read, and surf the internet ever since. This blog has one: https://chrisbergeron.com.

The Agentic Web is the next iteration of the internet, and we’re standing right at the moment it begins to unfold. The address of the future isn’t a URL. It’s a did:web. And much like the old days, getting there means taking an on-ramp to the new information superhighway. That’s where username.md comes in. For $9, you get a canonical address that you own, you regulate, and you control.

What is a DID?

Decentralized identifiers (DIDs) are globally unique, highly available, cryptographically verifiable digital identifiers. They’re usually written as a Uniform Resource Identifier (URI) that can point to a person, an organization, a data model, or any abstract entity.

The difference between a DID and a traditional identifier like an email address or a user account is simple but profound: a DID isn’t owned by any service provider. It works across platforms, and it prevents vendor lock-in.

DIDs are a W3C standard. They preserve privacy, enable consent and data portability, and put the user in control. Instead of passwords, they use public/private key pairs, which is a stronger security model on every axis. In short, DIDs form the basis of a Decentralized Public Key Infrastructure (DPKI) for the web.

“Decentralized, so why are you selling it?”

Fair question. If a DID is decentralized, doesn’t offering one make me a central authority?

In the near term, yes, and I’m fine saying so out loud. I built an on-ramp to a capability that today is locked inside a specification document. If you’d rather host your own DID documents on a domain you already own, you can. Look at the metadata at the top of this blog for a working example. That’s how I started: meta tags on chrisbergeron.com first, then a schema.org-compliant profile.

I want to unlock that capability for everyone, and username.md is simply the means to that end. Along the way I plan to keep shipping durable building blocks for the agentic web.

The enterprise has had tools like this for years. Regular people got nothing. Until now.

The future has landed

Mark Zuckerberg recently published a piece titled “The Future is for Everyone.” Read that again. If the future is for everyone, why announce it? Because Meta wants to be your on-ramp. So does Google. So does Microsoft. They want to provide your AI experience inside a walled garden that you enter exclusively with them.

You already know the screen. “Sign in with Google. Sign in with Facebook.”

Click it and you’ve agreed to their terms of service. You’ve handed them the license to shape your entire future relationship with AI. Do you trust them with that?

Because the agentic era raises questions that a login button can’t answer:

What does an AI agent actually know about you?

When one agent talks to another, who signed what?

Who’s accountable when something goes wrong?

Who governs the agents, and who proves compliance?

How can we trust agents to act on our behalf at all?

The answer to every one of those is verified identity. That’s what username.md provides.

What “verified identity” actually means in 2026

It comes down to three properties:

Provenance — the message provably came from an entity that holds a private key.

Anchoring — that key is bound to a stable, human-readable name (chris.username.md, not a random GUID).

Portability — the name belongs to no single platform. You can move the DID to a different host and agents still resolve the same identity.

Here’s what that looks like on the wire. An OIDC discovery response:

1 $ curl "https://login.username.md/.well-known/openid-configuration" 2>/dev/null | jq .

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 { "issuer": "https://login.username.md", "authorization_endpoint": "https://login.username.md/oauth/v2/authorize", "token_endpoint": "https://login.username.md/oauth/v2/token", "introspection_endpoint": "https://login.username.md/oauth/v2/introspect", "userinfo_endpoint": "https://login.username.md/oidc/v1/userinfo", "revocation_endpoint": "https://login.username.md/oauth/v2/revoke", "end_session_endpoint": "https://login.username.md/oidc/v1/end_session", "device_authorization_endpoint": "https://login.username.md/oauth/v2/device_authorization", "jwks_uri": "https://login.username.md/oauth/v2/keys", "scopes_supported": [ "openid", "profile", "email", "phone", "address", "offline_access" ] ... truncated }

And an RFC 9421 signature on every response your handle returns:

1 2 3 Content-Digest: sha-256=:: Signature-Input: sig1=("content-digest" "@authority");created=...;keyid="platform-ed25519";alg="ed25519" Signature: sig1=::

Every response from your handle is cryptographically signed, and any agent can verify it in about four lines of Go. If you want the details, the developer docs are here.

Why “sign in with Google” is not this

Google and GitHub can prove your account exists. They cannot prove you own your identity. The OAuth token they hand you is opaque: anyone can check who issued it, but it never gives you a signing key of your own. Send a message from [email protected] and there is no key you control behind it. It’s Google’s infrastructure, and Google isn’t going to give you the keys, because a captive user is a good user. If they close your account, you simply cease to exist online. By some reports that happens to hundreds of people every day.

OAuth was built for humans logging into apps. Agents need something OAuth was never asked to be.

What you actually get

Buy a handle and you get three things:

A verifiable identity you publish. chris.username.md resolves to a signed DID document, an OIDC discovery endpoint, an ATProto handle, and a plain-text, agent-readable profile. All for $9.

Native discoverability by agents. The signed SKILL.md at your handle tells other agents what you offer and how to reach you. They can verify it and trust it.

Ownership that outlives me. One payment. No subscription, no gas fees, no wallet. If the company disappears, your handle survives in a public DID registry snapshot.

Why now, why me, why username.md

I’ve spent most of my life in technology, starting at a help desk, moving through systems administration, and landing where I am now as a Principal Site Reliability Engineer. Longtime readers know DashPC and Dashboard Linux, and how I built in public the same kind of infotainment system that ships in every car today. It was greenfield, it was early, and it showed the world what was possible where automobiles met software.

I’m looking through that same lens again, and I’m handing you the missing piece of the AI puzzle. I’ve spent 20 years being “too early,” and I’ve made peace with it. I’m not claiming username.md is the next Cloudflare. But it could be.

Plant your flag

You can stake a claim in the new AI gold rush right now. Reserve your username for $9. That’s the whole ask. Buy one for your agent. Grab one for a family member or a friend before the good names are gone.

For $9 you can own your name on the internet, forever. Cryptographically. Portably.

Technology and standards

username.md is built entirely on open standards, and that’s the whole point. Every spec is published and linked: did:web, OIDC (RFC 6749 and OIDC Discovery), RFC 9421 signed responses, and the AT Protocol. The project is backed by my company, The Holding Company, and by chrisbergeron.com, the tech blog I’ve run since 2002.

I paid $9 to own my name on the internet forever. Now you can too: username.md

Why AI agents need verified identity

https://chrisbergeron.com/2026/08/11/why_ai_agents_need_verified_identity/

Author

Chris Bergeron

Posted on

08-11-2026

Updated on

08-11-2026

Licensed under

#bloglaunchoutline