AI agent real-name identity: SM2 keypair, QR real-name link, SD-JWT VP generate/verify.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts — it cannot prove the absence of malicious code.
AI agent real-name identity: SM2 keypair, QR real-name link, SD-JWT VP generate/verify.