LiveWhere are the public keys published?
Signing keys
Published unauthenticated as JWKS and as SPKI PEM, including retired keys, so records sealed before a rotation stay verifiable.
Published, not provided on request
A key you have to log in to fetch is a key nobody independent has seen. Both endpoints are unauthenticated and cacheable.
The PEM form matters: converting an OKP JWK into SPKI by hand is exactly the step most people get wrong, and getting it wrong makes 'verify with OpenSSL' a claim rather than an instruction.
Retired keys are published alongside the active one, each with its status, so historical records remain checkable across a rotation.
Check it yourself
The artifacts behind this page
- JWKS endpoint.presence-dossier-jwks.json →
What this page does not claim
Limits
- Key rotation must change the key id and move the outgoing key into the retired set. Reusing an id for new key material would make every pre-rotation record indistinguishable from a forgery.