 agents and web services MUST securely manage their cryptographic keys:</p> <ul> <li><strong>Private Keys</strong>: Must be stored securely and never shared.</li> <li><strong>Public Keys</strong>: Can be shared freely but must be verified to prevent man-in-the-middle attacks.</li> <li><strong>Key Rotation</strong>: Keys should be rotated periodically to limit the impact of key compromise.</li> </ul> <h2 id=5-policy-enforcement>5. Policy Enforcement<a class=headerlink href=#5-policy-enforcement title="Perman