Independent verification

Check a response without trusting us.

Every answer this system returns is signed over canonical JSON and carries the address of the key that signed it. That is only worth something if you can check it yourself, with tools you already have — so here is exactly how, in four steps, using nothing of ours.

What a signed response carries

Alongside the answer itself, every envelope carries the fields that make it checkable. Three of them are addresses you can fetch right now.

1 · Fetch the publisher's key set

Keys are per-publisher, not per-platform. Nothing about this request goes through an authenticated path, and the response is a standard JWKS document.

curl https://x-protocols.com/t/{publisher}/.well-known/x-protocol/jwks.json

{"keys":[{"kty":"OKP","crv":"Ed25519",
          "x":"…base64url public key…",
          "kid":"kc_…","use":"sig","alg":"EdDSA"}]}

Match the kid from the envelope's attestation block to a key in this set. A rotated key stays published, so an old envelope remains verifiable after a rotation.

2 · Recompute the digest

The signature is over a canonical serialisation of the payload, not over whatever bytes happened to arrive. Canonicalisation is deliberately boring, so that two implementations that have never seen each other agree:

• Object keys sorted, lexicographically, at every level.
• No insignificant whitespace: separators are , and : exactly.
• UTF-8, not escaped to ASCII.
• The digest is SHA-256 over those bytes, and the attestation block itself is excluded — a signature cannot cover itself.

3 · Check the signature

Any Ed25519 implementation will do. This is the whole check, in a language most people already have, importing nothing from us:

import base64, hashlib, json, urllib.request
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey

def b64u(s): return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))

env  = json.load(urllib.request.urlopen("…your saved envelope…"))
att  = env.pop("attestation")          # excluded from its own digest
body = json.dumps(env, sort_keys=True, separators=(",", ":"),
                  ensure_ascii=False).encode()

jwks = json.load(urllib.request.urlopen(att["jwks_url"]))
key  = next(k for k in jwks["keys"] if k["kid"] == att["kid"])

# Raises if the signature does not match. No news is good news.
Ed25519PublicKey.from_public_bytes(b64u(key["x"])).verify(
    b64u(att["signature"]), hashlib.sha256(body).digest())
print("signature valid")

4 · Check it has not expired or been withdrawn

A valid signature says the publisher asserted this. It does not say the assertion is still current — that is what the other two fields are for, and skipping them is the most common way a correct-looking verification is still wrong.

curl https://x-protocols.com/t/{publisher}/.well-known/x-protocol/revocations.json

Compare expires_at against now, then check whether this envelope's kid, entity or digest appears in the feed within a window covering when it was signed. Revocation is a window, not an instant: withdrawing a wrong answer must not also withdraw the correction that fixed it.

If a check fails

Treat the answer as unverified and tell us — sign in and use the support link, or write to the address on your invoice. A signature that does not verify is either a bug on our side or something worse, and both are things we want to hear about immediately.