·registration file served by this domainfetching…
·on-chain agentURI points back at that filecalling registry via public RPC…
·domain proof names the same agent idfetching…
·on-chain ownercalling registry via public RPC…
A registry entry establishes which agent this is. The on-chain record names this domain, the domain names the identity back, and your browser has just checked both directions.