e0ef3a27cc
doJSON, putBlob and getBlob now go through newSignedRequest, which attaches X-Unibus-Pub/Ts/Nonce/Sig signing membership.CanonicalRequest with the peer's Ed25519 key. GETs are signed too so the server can authenticate the caller uniformly under enforce. The payload-level owner signature (invite/rekey) is unchanged and coexists with this transport-level signature. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>