Forget IPs: using cryptography to verify bot and agent traffic