The A2A protocol currently lacks a mechanism to verify the authenticity of an Agent Card. When one agent retrieves another's Agent Card, it only reads metadata without any cryptographic proof of identity. This leaves agents vulnerable to impersonation, as anyone can create a fake Agent Card claiming a specific role. The protocol delegates identity verification to external, often manual, processes. While transport-layer security like mTLS secures the communication channel, it doesn't authenticate the agents themselves.To address this, a public key needs to be bound to the Agent Card, and critical fields must be signed. A verification step, similar to how HTTPS operates, is essential before any agent interactions occur. A manual workaround involves storing a public key in the extensions field and manually verifying message signatures. However, this approach is fragile, relies on inconsistent conventions, and can be exploited by malicious actors.The A2A specification requires a dedicated identity field in the Agent Card. This field should include a public key and a reference to its issuer, such as a Decentralized Identifier (DID). A signature scheme should be defined for the canonical JSON representation of the card. Crucially, verification of this identity must be a mandatory part of the A2A handshake.This proposed solution involves fetching the issuer's public key, verifying the card's signature, and checking for revocation status. This process ensures that the agent's card is trusted by a verifiable issuer and has not been compromised. Without this standardized solution, the current trust model in agent-to-agent communication remains a significant vulnerability, especially as agents begin to handle sensitive data and transactions.