simplify sigchain http distribution

docs/sshsigchain.md

@@ -446,12 +446,12 @@ anchoring, cached-head, and fork checks.
 
 ### 10.1 Static HTTP profile
 
-The static HTTP profile needs no server application or directory listing. For
-chain ID `<lowercase-chain-id>`, publish the bundle at:
-
-```text
-/.well-known/sshsigchain/v1/<lowercase-chain-id>/chain.sscb
-```
+The static HTTP profile needs no server application, directory listing,
+well-known path, or discovery protocol. Its `locator` is the exact arbitrary
+HTTP(S) URL of one canonical `.sscb` file. Implementations MUST NOT derive the
+URL from the chain ID, treat a URL as root-key discovery, or use a successful
+fetch as trust-on-first-use. The chain ID, namespace, and root public key are
+already pinned independently of the URL.
 
 The response media type SHOULD be:
 
@@ -459,23 +459,29 @@ The response media type SHOULD be:
 application/vnd.sshsigchain.bundle.v1
 ```
 
-A client performs an ordinary `GET`, accepts a successful full response, caps
-bytes while streaming, decodes the canonical bundle, requires its chain ID and
-namespace to match local trust, verifies the chain, verifies applicable head
-claims and receipts, then applies cached-head/fork rules. `404` means the source
-currently has no bundle. Servers SHOULD replace `chain.sscb` atomically.
+A client performs an ordinary `GET` of the exact configured URL, accepts a
+successful full response, caps bytes while streaming, decodes the canonical
+bundle, requires its chain ID and namespace to match local trust, verifies the
+chain, verifies applicable head claims and receipts, then applies
+cached-head/fork rules. `404` means the source currently has no bundle. Servers
+SHOULD replace the file atomically.
 
-Servers MAY expose the lowercase bundle hash as a strong `ETag`; clients MAY use
-`If-None-Match`. HTTP cache validators are performance hints, not trust. HTTPS
-protects privacy, locators, and availability against network interference, but
-SSHSIGCHAIN verification remains mandatory even over authenticated HTTPS.
-Plain HTTP remains integrity-safe only in the narrow sense that tampering is
-detected; it offers no confidentiality or reliable availability.
+Servers SHOULD expose the lowercase bundle hash as a strong `ETag`; clients
+SHOULD use `If-None-Match`. A mutable latest-version URL SHOULD use
+`Cache-Control: no-cache` or a suitably short freshness lifetime so ordinary
+HTTP caches and CDNs can store the file and revalidate it. HTTP cache validators
+are performance hints, not trust. HTTPS protects privacy, locators, and
+availability against network interference, but SSHSIGCHAIN verification
+remains mandatory even over authenticated HTTPS. Plain HTTP remains
+integrity-safe only in the narrow sense that tampering is detected; it offers
+no confidentiality or reliable availability.
 
-This full-snapshot profile intentionally favors deployment with a static file
-server. A later chunked profile may add immutable hash-addressed objects and a
-small mutable manifest, but it must preserve the object encodings and all
-verification rules above.
+Servers MAY support byte ranges, and clients MAY use them to resume or
+parallelize transfer of the single file. The v1 bundle has no authenticated
+random-access index: a client MUST assemble, decode, hash, and verify the
+complete canonical bundle before accepting any state. A `206 Partial Content`
+response is therefore a download optimization, not a partial-chain or
+per-object protocol. This profile deliberately remains one file.
 
 ## 11. JSONL interchange