[graywolf336]

Why

Signed objects (attestations, delegations) carry only the signer's did:atomic:... identifier — base32(blake3(public_key)), a one-way fingerprint of the key. Verifying such an object requires recovering the public key by DID, which the client had no path to do.

The server side (companion PR in atomic-storage — linked below) adds GET /identities/by-did/{did}, backed by a new key_fingerprint lookup column.

What

StorageClient::resolve_identity_by_did(did) in atomic-remote/src/storage.rs, next to the existing public-key resolution:

• Calls GET /identities/by-did/{did} with the same bearer auth as resolve_identity_by_email/by_name (the endpoint is authenticated because holding a DID proves nothing — DIDs circulate in public signed objects).
• Verifies the answer before returning it as success: the returned key is re-checked with atomic_canonical::did::did_matches_public_key. The server indexes by the fingerprint, so a spoofed answer would otherwise be well-formed — and a client that trusts this key to verify a signature must not take it on faith. Mismatch, missing key, and unparseable key all fail the call; never silently succeed. (Done inside the method, so callers cannot forget it.)
• Tests: match passes; mismatch / missing / unparseable all error.

atomic-identity added as a dependency of atomic-remote for PublicKey::from_base32 (already a workspace member dep).

Verification

cargo fmt -p atomic-remote -- --check
cargo clippy -p atomic-remote --all-targets -- -D warnings   # clean
cargo test -p atomic-remote                                  # 221+14 pass

Companion

Server PR: atomicdotdev/atomic-storage#108 (merge server first or ship together — this method 404s against servers without the endpoint, which surfaces as a clean RemoteError, not a panic).

[graywolf336]

Heads-up for reviewers: this branch is intentionally based on a4e2809 (the commit just before #207 merged to dev), not dev tip. atomic-storage's CI resolves the sibling checkout by branch name, and storage has not yet adapted to the #207 align_to_view/TrackingOptions API changes — pinning the sibling to the last compatible commit keeps the companion storage PR's CI meaningful. The diff against dev is unaffected (merge-base is a4e2809); I verified fmt/clippy/test for atomic-remote on this base.