NetworkKeyGrantSignature

Authenticates a network-key grant using Velocity's modern-forwarding secret.

The grant travels the proxy→backend connection, so it is already confined to a link the network trusts for player forwarding. Where a stronger anchor exists, use it: a Velocity network running modern forwarding must hold the same secret on the proxy and on every backend, or players cannot connect at all. That makes it a free, already-shared signing key — nothing new for an operator to configure or leak.

The secret itself is never transmitted; only an HMAC over the granted key.

Signing is best-effort by necessity — BungeeCord has no equivalent secret (ip_forward is a plain boolean), and Velocity's legacy forwarding mode doesn't use one either. The downgrade is closed at the verifying end instead: a backend that holds a secret demands a valid signature, so an attacker cannot strip the signature to bypass the check. A backend with no secret accepts an unsigned grant, because on that topology nothing better exists.