auth: Add DNS auth (#279)

Fixes #270
Closes #233

Adds support for DNS-based authentication for proving ownership of a
particular domain. E.g. if you can add a TXT record to `anthropic.com`,
you can publish anything at `com.anthropic/*` or `com.anthropic.*`.

Notes:
- Uses Ed25519 signatures with 15-second timestamp windows to prevent
replay attacks
- Supports multiple public keys in DNS TXT records for key rotation
scenarios
- Publisher CLI supports DNS auth via --dns-domain and --dns-private-key
flags
- Includes key generation commands in publisher README for easy setup

## Motivation and Context

This implements DNS-based public/private key authentication to allow
people to actually publish at their own domains. Currently,
authentication requires GitHub accounts which limits publishing to the
io.github.* namespace.

DNS-based auth enables:
- Publishing under your actual domain (e.g., com.anthropic/* for
anthropic.com)
- Independence from GitHub or other external auth providers
- Organizations managing their own keys and access to publishing

## How Has This Been Tested?

- Unit tests cover signature verification, DNS TXT parsing, timestamp
validation, and error cases
- Tested locally by editing my own DNS records
- All existing auth methods covered by passing tests

## Breaking Changes

None

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed

## Additional context

Will be adding HTTP challenge auth in a similar way as a separate PR,
e.g. for verifying you own `github.com` by hosting a
`github.com/.well-known/mcp-server-challenge` or similar. Just
mentioning this as we discussed HTTP challenges as closely related to
DNS challenges elsewhere, and want to reassure reviewer that this hasn't
been forgotten with this approach. :) Update: tracking the HTTP auth in
https://github.com/modelcontextprotocol/registry/issues/280

tools/publisher/README.md

@@ -48,7 +48,10 @@ The tool supports two main commands:
 - `--auth-method`: Authentication method to use (default: github-at)
   - `github-at`: Interactive GitHub OAuth device flow authentication
   - `github-oidc`: GitHub Actions OIDC authentication (for CI/CD)
+  - `dns`: DNS-based public/private key authentication
   - `none`: No authentication (for registry contributors testing locally)
+- `--dns-domain`: Domain name for DNS authentication (required for dns auth method)
+- `--dns-private-key`: 64-character hex seed for DNS authentication (required for dns auth method)
 
 ## Creating a server.json file
 
@@ -182,6 +185,31 @@ jobs:
             --auth-method github-oidc
 ```
 
+### DNS Authentication (`dns`)
+
+For domain-based authentication using public/private key cryptography:
+
+1. **Generate Ed25519 keypair**: 
+   ```bash
+   openssl genpkey -algorithm Ed25519 -out /tmp/key.pem && \
+   echo "\n\nDNS record to add to your domain:" && \
+   echo "  Type: TXT" && \
+   echo "  Value: v=MCPv1; k=ed25519; p=$(openssl pkey -in /tmp/key.pem -pubout -outform DER | tail -c 32 | base64)" && \
+   echo "" && \
+   echo "Private key for --dns-private-key flag:" && \
+   echo "  $(openssl pkey -in /tmp/key.pem -noout -text | grep -A3 "priv:" | tail -n +2 | tr -d ' :\n')\n" && \
+   rm /tmp/key.pem
+   ```
+2. **Add DNS TXT record**: Add a TXT record to your domain with format: `v=MCPv1; k=ed25519; p=<base64-public-key>`
+3. **Use CLI arguments**: Provide domain and private key via command line flags
+
+```bash
+./bin/mcp-publisher publish --registry-url <REGISTRY_URL> --mcp-file <PATH_TO_MCP_FILE> \
+  --auth-method dns --dns-domain example.com --dns-private-key abc123...
+```
+
+This grants publishing permissions for both `example.com/*` and `*.example.com/*` namespaces.
+
 ### No Authentication (`none`)
 
 Mainly for registry contributors, for testing locally: