[Xe]

Summary

Directory response signatures (protocol draft Appendix B.1) were only checked when VerifyDirectorySignatures was set. By default, a signed directory with forged or tampered signatures was accepted silently.

This adds FetcherOptions.DirectorySignatures with three policies:

• DirectorySignaturesPrefer (zero value, new default): an unsigned directory is accepted, as the draft allows ("A verifier MAY use a key obtained by resolving the directory itself whether or not it has valid proof"). A directory that carries any http-message-signatures-directory signature, or unparsable signature headers, is held to the full B.1 check, and keys that fail it are dropped.
• DirectorySignaturesRequire: drop every key without a valid signature.
• DirectorySignaturesIgnore: skip the check.

VerifyDirectorySignatures is kept as a deprecated alias for Require, so existing callers still compile.

Behavior change

• Unsigned directories: no change.
• Signed directories with bad signatures or a body that does not match Content-Digest: keys are now dropped by default (reported in Directory.Invalid with ErrDirectoryUnbound).
• In prefer mode, once a directory has any signature, every key needs one. A server that signs some keys but not others loses the unsigned ones. DirectoryHandler signs every key, so it is not affected.

Testing

• New table test TestFetcherDirectorySignaturePolicy covers each policy against signed, unsigned, forged, and tampered directories, plus the deprecated bool.
• CGO_ENABLED=1 go test -race -count=1 ./... passes.

Assisted-by: Claude Opus 5.5 via Claude Code