Every verdict.json is signed with minisign. Retired keys stay listed so verdicts they signed remain checkable; they are never re-signed.
| status | key_id | public key | since | until | reason | file |
|---|---|---|---|---|---|---|
| active | 3E85581A108897CB | RWTLl4gQGliFPuGuIrCBQrK+Mq7qrxiAqr3s/tD4V5Rbt5I/OiL53+zj | 2026-10-18T18:40:30Z | — | keys/verifier-20261018-184030.pub | |
| retired | 3DCB8A10CB77C019 | RWQZwHfLEIrLPZvZ/gB2x5CN12FFEtdncN//6JkcXYDs0QzsrQ33f6Nx | 2026-10-16T15:50:51Z | 2026-10-18T18:40:30Z | old key exposed in git history | keys/verifier-legacy-3DCB8A10CB77C019.pub |
Each verdict records the key_id of the key that signed it. To check one yourself, download verdict.json and verdict.json.minisig from the ledger, then run
minisign -Vm verdict.json -P <pubkey> with the public key whose key_id matches. A retired key verifies verdicts signed before its "until" time; anything signed later should be treated as suspect. From a harness checkout, python3 verify.py --check-verdict verdict.json --keys keys/KEYS.json does the lookup for you.