[Browser Rendering] Add signature headers

Author: ToriLindsay

src/content/docs/browser-rendering/reference/automatic-request-headers.mdx

@@ -5,15 +5,19 @@ sidebar:
   order: 2
 ---
 
-When using the [REST API](/browser-rendering/rest-api/) to fetch content via Browser Rendering, Cloudflare adds the following headers to outbound requests made to the target URL:
+Cloudflare automatically attaches headers to every [REST API](/browser-rendering/rest-api/) request made through Browser Rendering. These headers make it easy for destination servers to identify that these requests came from Cloudflare.
+
+:::note[Note]
+
+These headers are meant to ensure transparency and cannot be removed or overridden (with `setExtraHTTPHeaders`, for example).
+
+:::
 
 | Header               | Description                                                                         |
 | -------------------- | ----------------------------------------------------------------------------------- |
 | `cf-biso-request-id` | A unique identifier for the Browser Rendering request                               |
 | `cf-biso-devtools`   | A flag indicating the request originated from Cloudflare's rendering infrastructure |
+| `signature-agent`    | [The location of the bot public keys](https://web-bot-auth.cloudflare-browser-rendering-085.workers.dev/.well-known/http-message-signatures-directory), used to sign the request and verify it came from Cloudflare                                       |
+| `signature` and `signature-input`| A digital signature, used to verify requests, as shown in [this architecture document](https://datatracker.ietf.org/doc/html/draft-meunier-web-bot-auth-architecture)                     |
 
-:::note[Note]
-
-These headers are unique to Browser Rendering and are automatically included and cannot be removed or overridden (such as via `setExtraHTTPHeaders`). They are intended to ensure transparency, allowing destination servers to identify traffic as coming from Cloudflare Browser Rendering.
-
-:::
+The `signature` headers are cryptographic proof that confirms the request was created by an authorized bot using HTTP message signatures. Learn more in the Cloudflare blog: [Forget IPs: using cryptography to verify bot and agent traffic](https://blog.cloudflare.com/web-bot-auth/).