Caller-configured discovery trust root. new/1 requires :type (:directory, :jwks_uri, or :cimd) and :location (HTTPS URL, at most 2,048 bytes). A directory origin expands to /.well-known/http-message-signatures-directory. CIMD requires a nonempty path; URLs reject userinfo, fragments and dot segments. For CIMD, pass :location with exactly the spelling of the document's client_id, including scheme/host case, any trailing host dot and explicit port. The client ID comparison is exact; origin normalization for fetching and same-origin checks never changes that comparison.

Options: :key_id (:thumbprint, default, or explicit :directory). Thumbprint mode requires any supplied JWK kid to equal its RFC thumbprint. Directory mode requires a unique kid per JWK (1..256 printable ASCII bytes), preserves its spelling, and keeps thumbprints as the revocation identity. Directory proof sources (type: :directory) require thumbprint mode; their signed proof identifies its verification key by thumbprint. Duplicate IDs reject among eligible entries only; expired, not-yet-valid, revoked, or incompatible entries do not reserve an ID during rotation. :cacerts (:os or DER roots, default :os), :permitted_addresses (at most 16 exact IP tuples, default none), :revoked (at most 256 RFC thumbprints), :require_signed_directory (true), :max_redirects (0, at most 3), :redirect_scope (:same_origin, or explicit :any_https), :max_bytes (65,536, at most 1,048,576), :max_decoded_bytes (65,536, same bound), :max_keys (32, at most 256), :timeout (5,000 milliseconds, 1–300,000), :min_ttl (300 seconds), :max_ttl (86,400 seconds, at most 604,800), :negative_ttl (30 seconds, at most 300). min_ttl supplies fallback freshness only when neither max-age nor Expires is present; it never extends explicit freshness or a key/signature expiry. Invalid negative_ttl returns :invalid_options. CIMD response content additionally has a 5,120-byte cap.

Unknown keys reject. Modified structs are revalidated at every fetch. Inspection excludes locations, addresses, trust roots and revoked IDs. No networking occurs during construction. Starting SSL remains the caller's responsibility.