[franzvill]

Thanks for flagging this! You're absolutely right about network security.

The spec does require TLS - from Section 4.1: > "All HTTP endpoints MUST use TLS 1.2 or higher" > "Clients MUST verify TLS certificates"

The `http://localhost:8080` example is just for local development/demo purposes. In production, all discovery endpoints and AgentCard fetches must use HTTPS.