Like every Web3Signed read (data, lineage), the Personal Server verifies the signature over the PATH; per-scope authorization is enforced live against the caller's grant on each request, so the query needs no signature to be safe. Only the write path signs path AND query, where a parameter decides what is written.
The request target for a status read: the query carries the derived scope, the signed
uridoes not.