Google published some "experimental" new developer documentation about Web Bot Auth. It's supposed to help site owners validate that bots are authentic.

"Instead of relying solely on self-reported headers and IP addresses, Web Bot Auth allows agents to cryptographically sign their requests. Using Web Bot Auth helps website owners identify automated traffic on their sites, and prevents other actors from attempting to spoof reputable agents."