{"alg":"Ed25519","key_id":"01833acd46d06ab4","public_key_pem":"-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAsEBWg2cdc3sb0HAozBmtuk9q9hEdyG2bcLq4gpfudWg=\n-----END PUBLIC KEY-----\n","public_key_spki_b64":"MCowBQYDK2VwAyEAsEBWg2cdc3sb0HAozBmtuk9q9hEdyG2bcLq4gpfudWg=","verifies":"the `package_signature` on a VITNA evidence export (GET /api/evidence/export?format=json)","proves":"The exact package was issued by VITNA (the holder of the evidence private key) and has not been altered since export. It does NOT prove the underlying records are factually true — it attests issuance + integrity of the package.","how_to_verify_offline":"Recompute the canonical JSON of `evidence_package` (object keys sorted recursively, no whitespace), then Ed25519-verify `package_signature.signature` (base64) against this public key. When the package carries `record_hashes`, also recompute sha256 over each record's canonical JSON and match it at its position for per-record verification. Reference implementation (downloadable, dependency-free): https://raw.githubusercontent.com/COSTRINITY/vitna-compliance-mcp/main/verify-evidence.mjs"}