A2A 1.0: Sign and Verify Agent Cards Before Delegating

On August 17, Google's Agent2Agent protocol moved out of the Linux Foundation's general portfolio and became a hosted project of the Agentic AI Foundation, the same body that stewards MCP. The foundation has gone from under 40 member organizations at its December 2025 launch to more than 250, with Google, Microsoft, Amazon, Anthropic, OpenAI, Bloomberg, Shopify and Block on the list. A2A and MCP now sit under one roof: MCP is how an agent reaches tools, A2A is how an agent reaches another agent.

That governance news is the headline. The part that actually changes your code is quieter. A2A hit v1.0, and the Agent Card — the JSON business card every agent publishes so other agents can find it — was restructured with several breaking changes. v1.0 also added the thing people had been asking for since 2025: cryptographically signed Agent Cards, using JWS over RFC 8785 canonical JSON.