FNWT: A Federated Cryptographic Domain-Identity Protocol for Legally Accountable Web Origins with Freshness-Bounded Lifecycle Status and Browser Enforcement

This study presents Federated National Web Trust (FNWT), a compositional cryptographic protocol profile for institutional web-origin authentication. A signed Domain Identity Credential binds a legal-entity identifier, a Hypertext Transfer Protocol Secure (HTTPS) host and the SubjectPublicKeyInfo (SPKI) of the Transport Layer Security (TLS) authentication key, subject to independent identity proofing. The profile combines transparency, freshness-bounded status, constrained federation and deterministic user-agent decisions. The historical 100,000-record corpus is evaluated as policy conformance, not independent phishing-detection accuracy. Reference verification adds 900 signed-fixture cases across 75 families, 192 stateful checks, 96 enrollment checks and 5000 structured mutations. Actual loopback transport testing adds 128 TLS/evidence paths and 16 negative handshake checks. A matched envelope comparison executes 324 cases and 3000 timing observations across JavaScript Object Notation (JSON), compact JSON Web Signature (JWS) and an experimental X.509 encoding. Observed decisions match the specified outcomes; negative controls demonstrate that valid issuer signatures do not establish the truth of the signed claims. Twenty-process full-verification measurements give medians of 1.264 ms for direct trust and 1.421 ms for federation; these are distinct from the envelope-only measurements. Network/cache behavior is examined through 90,000 conditional simulation events. A Chromium controller and 96 mocked adapter tests are released, but native navigation and user-visible latency remain unvalidated. Using the supplied score for blocking at threshold 70 would additionally block 739 legitimate-labelled and 719 unknown-labelled records. The findings establish reproducible evidence-path behavior and measurable encoding tradeoffs.