This is exactly why I built username.md We cryptographically prove identity and authorization grants.

Granted, it wouldn’t have helped in OP’s situation because the agent was the user by proxy.

I mention it toward your latter exemption.