📡 CAEP / Shared Signals
OpenID Shared Signals Framework (SSF) + CAEP. A security action here becomes a signed Security Event Token (RFC 8417), pushed toward a receiver, and verified against the JWKS — the real-time telemetry a CAEP-aware IdP sends every relying party.
In a real deployment the transmitter (this app) pushes a signed SET to a receiver's own endpoint over HTTPS, and the receiver verifies it against the
transmitter's published JWKS before ever acting on it. Here the transmitter and receiver are
the SAME Worker — there's no second party to push to — so delivery happens
in-process instead of over the network. Every other step is standards-correct: a real ES256
JWS (jose, no hand-rolled crypto), and a real
iss/aud/signature check against the Lab's JWKS. This receiver is a teaching simulation, not a certified SSF endpoint.