To limit tracking risks, implementations SHOULD avoid long-lived, globally unique key identifiers unless strictly necessary. Key rotation SHOULD be supported, and clients SHOULD take care to avoid signing information that could be used to correlate activity across contexts, especially where sensitive user data is involved.
-- https://datatracker.ietf.org/doc/html/draft-meunier-webbotauth-httpsig-protocol-01#section-7.3-1
The thing is, the entire point of this mechanism is to provide a consistent, long-lived, globally-unique identifier for the client. So this text is a bit weird.
Obviously, a single client can assume multiple identities over time, according to its own needs, which is maybe something you can directly acknowledge (or not, because people can work that out for themselves). Other than that, just make it clear that the reason to use this mechanism is to enable tracking of requests in a verifiable way. Clients / Agents choose to do that because they believe that it might allow them to build (or build upon) a positive reputation with servers. And because they consider the value of that reputation to exceed the value of any privacy they might get from not being traceable in that way. That framing should be in the introduction, not Section 7.3, of course.
-- https://datatracker.ietf.org/doc/html/draft-meunier-webbotauth-httpsig-protocol-01#section-7.3-1
The thing is, the entire point of this mechanism is to provide a consistent, long-lived, globally-unique identifier for the client. So this text is a bit weird.
Obviously, a single client can assume multiple identities over time, according to its own needs, which is maybe something you can directly acknowledge (or not, because people can work that out for themselves). Other than that, just make it clear that the reason to use this mechanism is to enable tracking of requests in a verifiable way. Clients / Agents choose to do that because they believe that it might allow them to build (or build upon) a positive reputation with servers. And because they consider the value of that reputation to exceed the value of any privacy they might get from not being traceable in that way. That framing should be in the introduction, not Section 7.3, of course.