Add ES256 (P-256/secp256r1) verification support alongside Ed25519

[tomjwxf]

Add ES256 (P-256/secp256r1) verification support alongside Ed25519. Motivated by Revettr's RFC 7515 compact JWS envelopes. JWKS resolution pattern is identical

[aeoess]

+1 on adding ES256 alongside Ed25519. The fetch-JWKS → resolve-kid → verify-signature pattern is identical regardless of algorithm, so the extension surface is small.

One observation from the APS side: our gateway emits Ed25519 only and we have no immediate plan to change that, so we're not the consumer driving the request. But the broader ecosystem is converging on dual-algorithm support — Concordia v0.4.0 is committing to ES256 alongside EdDSA per A2A #1734, A2CN under separate discussion, Revettr already ES256-native — so once @veritasacta/verify accepts both, single-verifier-across-issuers becomes possible.

If a test fixture covering both alg branches is useful, the Revettr envelopes once they ship the Ed25519 sibling will give you matched-pair coverage in one envelope (same canonical payload, two signatures, two algorithms). That's probably stronger than synthetic vectors.

[tomjwxf]

@aeoess useful context on the convergence. Agreed on all points. The IETF draft already specifies this — draft-farley-acta-signed-receipts-02 says verifiers MUST support EdDSA and SHOULD support ES256. The implementation catches up to the spec.

Implementation approach:

• Dispatch on the alg field in the receipt's signature object. JCS canonicalization is algorithm-agnostic — the only change is the final verify() call.
• P-256 via @noble/curves/p256 (same audited library family as @noble/ed25519). Extension surface is small, as you noted.
• --self-test will exercise both algorithm branches.

On test vectors the Revettr matched-pair approach (same canonical payload, two signatures, two algorithms) is better than synthetic vectors. Happy to wait for those to ship. In the meantime I'll build against generated fixtures and swap in real envelopes when available.

The interop fixtures for agentid-aps-interop will include ES256 vectors alongside Ed25519 once this lands - so the cross-issuer verification story covers both algorithms from day one.

Targeting 0.4.0 for this.