Authority Notary v3

Verify a record in your browser

This page re-derives the checks from the record itself. It is not calling a verification endpoint: the SHA-256 and Ed25519 maths run here, in your tab, with WebCrypto. It imports no CAIN code, which is the point — a verdict that depends on the claimant's server is not a verdict.

1. Pin the key yourself

A bundle that hands you the key it was signed with proves nothing: anyone who can hand you a bundle can re-sign every record with their own key. Paste the issuer's key from a source you trust. If you have none, the second button uses the key this host publishes — that is trust-on-first-use, not a pin, and the page will say so.

Ed25519 public key (base64, 32 bytes)

2. Run the checks

Nothing verified yet.

What this checks, and what it does not

Checks: the record hash, the Ed25519 signature against your pinned key, the layers_sha256 binding, the L1 delegation invariants (parent binding, monotonic attenuation, principal invariance, expiry monotonicity), the L4 containment rules (tool scope, parameter and value widening, budget, settlement), and that the composed verdict is the strictest layer.
Does not check: whether the predicates describe the real world; whether the quorum replicas are honest (that is L0 and needs the pinned replica key set, see verify_notary.py); and it is not a third-party audit. Same-operator evidence.