Signed URLs fit when each object needs its own expiry window, but Expires, Signature, and Key-Pair-Id in the query string must stay out of the public cache key or every mint creates a unique edge object. Keep signature validation on the private behaviour, then serve the body under the same host-path key anonymous fills would use so cardinality stays flat. Prefer short-lived signatures for downloads or rentals, and rotate key groups on a schedule rather than only after an incident.

Ops prove-out after tightening the cache policy: request the same private object twice with two freshly minted signatures and expect MISS then HIT with a rising Age on the shareable body; repeat with an expired or stripped signature and confirm the edge rejects before any origin fill. After rotating a key group, invalidate the private paths that still hold bodies signed under the old key and re-check X-Cache until the prior object is gone — most post-rotation tickets are an un-purged edge object or Signature still folded into the public key, not a broken signer.