Publication signing keys

Every publication manifest is signed with an Ed25519 key. The private half is held outside the web application. Public keys are published here permanently: a key that is retired stays on this page with its retirement date, so a signature made years earlier remains verifiable.

-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEABbWgDFdScXX0uH5utToJDwC80DCEuS1erP+4KvhMoVQ=
-----END PUBLIC KEY-----

Verifying a signature

curl -sO https://opentechnical.org/p/OT-2026-000000001/manifest.json curl -sO https://opentechnical.org/p/OT-2026-000000001/manifest.sig curl -s https://opentechnical.org/integrity/keys.json | jq -r '.keys[0].public_key_pem' > ot.pem base64 -d manifest.sig > manifest.sig.bin openssl pkeyutl -verify -pubin -inkey ot.pem -rawin -in manifest.json -sigfile manifest.sig.bin

The signature covers manifest.json byte for byte. The manifest in turn lists the SHA-256 of every published file, so verifying the signature and then re-hashing the files establishes the whole publication.

Machine-readable key list