Keryx _sig extension

This is the identity URL of the _sig JSON Feed extension used by the Keryx protocol (see README.md in this repository). Generic JSON Feed readers ignore the extension; the Keryx app enforces it.

Items (PROTOCOL §8.2)

• channel — the delegated channel role the item belongs to (cross-checked against the feed path)
• withdrawn — signed retraction: the app hides the item entirely
• signatures — raw Ed25519 (base64url) over the JCS (RFC 8785) canonical bytes of the item with this field removed

Private capability feeds (PROTOCOL §10)

The top-level _sig of a private feed additionally carries:

• channel — MUST equal the authorized pattern entry's channel
• url — the canonical capability URL (MUST equal the fetched URL)
• signatures — Ed25519 over the whole document (top-level _sig.signatures removed)
• version — monotonic per feed (anti-rollback via client version memory)
• expires — the order window end (anti-freeze)