{
 "schema_version": "1.0",
 "issuer": "https://etymolt.com",
 "keys": [
 {
 "key_id": "etymolt-1779085662",
 "algorithm": "Ed25519",
 "use": "sig",
 "status": "active",
 "created_at": "2026-05-18T06:27:58.929724Z",
 "public_key_pem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAZVzxOiKQipJT0Tj+JbOF3K+qhlD9z0DqbGUWXXIwE0U=\n-----END PUBLIC KEY-----\n",
 "fingerprint_sha256": "97f17f22f12461649287bc0947d54584e6da2325147bf792e1617f492684866d"
 },
 {
 "key_id": "vk-2026-05-17-e9f578a9",
 "algorithm": "Ed25519",
 "use": "sig",
 "status": "rotated",
 "created_at": "2026-05-17T20:30:00Z",
 "rotated_at": "2026-05-18T06:27:58Z",
 "rotation_reason": "Initial keypair private half was generated in an agent conversation context and never deployed to production. Rotated for operational hygiene to a key whose private half lives only on the operator machine + in Railway env vars.",
 "public_key_pem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEApGjdO/wBh0hkK73mDe9Jd2RrBdVW32BcrX9NhiCjMdU=\n-----END PUBLIC KEY-----\n",
 "fingerprint_sha256": "ccd9addbf7a888c3272008e037bd9a2b758cf43313aad377402f5374b040dcc2",
 "signatures_issued": 0
 }
 ],
 "verifier_documentation": "https://docs.etymolt.com/verdict-signing",
 "rotation_policy": "Keys carry status=active|rotated|revoked. Verifiers MUST match by `key_id` from the verdict's `signature_key_id` field. A `rotated` key remains in the registry for ~30 days to allow grace-period verification of old signatures; clients SHOULD treat verdicts signed by `rotated` keys as advisory rather than fresh. A `revoked` key invalidates ALL its signatures retroactively (security breach response).",
 "notes": "Etymolt verdicts are Ed25519-signed. Verify by extracting the `signature_b64` field from a verdict response and validating against the key matching the verdict's `signature_key_id`. The active key is the one issuing new signatures today; rotated keys are kept for grace-period verification."
}