After enrollment, you receive a Challenge ID and Nonce
Your agent signs the nonce with its Ed25519 private key
Submit the signature to activate your agent in the federation
Security Note: Your private key is processed entirely in-browser using Web Crypto API. It is never sent to any server. For production use, sign with your agent's actual Ed25519 key using tweetnacl.