{"kid":"d06c6006c5d560e9","alg":"Ed25519","public_key":"MCowBQYDK2VwAyEAhJDeHuf6ZAPaBGIvQAsv7sRXYwArk3pc4I/goB0qWo8=","public_key_format":"SPKI DER, base64","signed_message":"sirenic-v1:{kid}:{timestamp}:{body_sha256_base64}","headers":{"key_id":"X-Sirenic-Key-Id","timestamp":"X-Sirenic-Timestamp","signature":"X-Sirenic-Signature"},"scope":"Every 2xx /v1 response. Hash the raw response body bytes (sha256, base64), rebuild the signed message with the kid and timestamp headers, then verify the Ed25519 signature header against the public_key of the entry of keys whose kid is the key id header (kid and public_key above are the key signing today). Every 2xx of a priced route also carries X-Sirenic-Verification-Id: GET /verifier/{number} re-verifies the stored signature with the key of its kid and shows its public receipt, never the data.","keys":[{"kid":"d06c6006c5d560e9","alg":"Ed25519","public_key":"MCowBQYDK2VwAyEAhJDeHuf6ZAPaBGIvQAsv7sRXYwArk3pc4I/goB0qWo8=","valid_from":"2026-07-20","valid_until":null}],"keys_policy":"keys lists every key that has ever signed a response, and an entry is never removed: a response signed months or years ago verifies with the entry of its kid. valid_from and valid_until are UTC days bounding, inclusively, when the key may have signed (valid_from is a lower bound); valid_until is null while the key may still sign. A watch token (sw_...) names its key in its fourth segment; an older token without it verifies with the keys whose days contain its timestamp."}