DNSMint

Every agent gets its own registered domain. Its own HTTPS endpoint, its own MX so it can receive mail, and DNSSEC signed with the key at the registry before it serves. One API call, certificate included. No registrar account.