DPoP

A count here is providers whose published contract declares this header — not providers who send it. Response headers set at the edge rarely appear in an OpenAPI at all, so a low number can measure documentation practice rather than deployment.

Basis: mandated. The law, or a technical standard the law makes binding, names this header. Only a credentialed caller can observe it in flight — the catalog can see a contract declare it, not a deployment honour it.