> > > My next step would be to prototype Option B on my fork: put local signing > behind the S3 configuration, work through how to represent the account ID > and jurisdiction, and rerun the client test matrix.. I’ll check that the > configuration changes preserve existing S3 and STS behavior.
Thanks, Austen, that sounds like a solid next step. Good to see Option B taken forward, and checking that the config changes preserve existing S3 and STS behavior is exactly the part I'd have worried about most. One small nudge while you're in there: since the account ID and jurisdiction modeling is the crux of fitting into the S3 config, it might help to sketch it against a couple of other S3-compatible backends too, not just R2. Even a rough look at how something like MinIO or Blackblaze would slot into the same fields could tell us early whether the shape generalizes or ends up R2-specific. Better to catch that before the vending path hardens around one backend. Nothing that needs full implementation, just enough to pressure-test the config surface. Appreciate you carrying this forward. Sushant
