Do I need an account with Flashy to verify an agent?

No, and that is the point. The signing keys are public, the wire format is published, and the whole verification runs on your side against a cached JWKS. If verification required a relationship with us, the network would be exactly as large as our customer list.

The artifact that settles it
/.well-known/jwks.json · unauthenticated
↑ delegated authority→ the definition lens · gda.group↓ the verifier