F21-GN: Yes
Rationale
The CADET API exposes the initiating PeerIdentity to the incoming-channel callback and the destination identity to the caller creating an outgoing channel. Tunnel key derivation incorporates the expected peer long-term public key; authenticated decryption precedes dispatch of channel messages. This makes the cryptographic final-peer identity available without an application JWT layer. It does not assert a civil identity or application authorization policy.
Assessment method
Pinned release-source analysis and primary protocol review; no runtime execution
Source context
src/include/gnunet_cadet_service.h: GNUNET_CADET_ConnectEventHandler; src/cadet/cadet_api.c: incoming callback; src/cadet/gnunet-service-cadet_tunnels.c: update_ax_by_kx, GCT_handle_kx_auth, GCT_handle_encrypted
Outstanding qualification
Connect known-key peers over a relay, compare callback identity with the expected key, and inject a mismatched-key peer. Verify authentication failure and no payload callback; no cryptographic or runtime audit performed.