Key transparency

The keys that sign every check.

Every compliance result is an Ed25519-signed attestation. A signature is only as trustworthy as the key behind it — so this page publishes that key openly: its fingerprint, how the fingerprint is derived, where to fetch it, and how rotation works. The current key is fetched live from the published endpoint below, so this page and the API can never silently disagree.

Current signing key

Active attestation key

Ed25519 · signing

Status

Fetching from live endpoint…

Key ID

—

Algorithm

—

SHA-256 fingerprint (of the SPKI DER public key)

—

Public key (PEM)

—

Fetch raw key JSON →

How the fingerprint is derived

The key ID isn't arbitrary — it's derived deterministically from the public key itself, so it can't be forged or reassigned to a different key. Anyone can reproduce it from the published PEM and confirm it matches:

Export the public key as SPKI DER

The raw binary form of the Ed25519 public key — the same bytes inside the PEM shown above.

SHA-256 the DER bytes

A standard hash over the key material. The full hex/base64url digest is the fingerprint field above.

Prefix and truncate for the key ID

The key ID is ed25519- followed by the first 16 characters of the base64url digest. Short enough to reference, unique per key.

Reproduce it yourself from the PEM with one command:

openssl pkey -pubin -in key.pem -outform DER | openssl dgst -sha256 -binary | basenc --base64url | cut -c1-16 # prepend "ed25519-" to get the key ID

Verifying an attestation against this key

Signatures are computed over JSON.stringify({ data, issued_at, key_id }) from the response body, using the key above. You never have to trust this site or the API to check one — verification runs entirely against the published public key, offline if you want. The SDK does it in a line:

import { OnchainDiligence } from '@onchaindiligence/sdk' const od = new OnchainDiligence({ account }) const r = await od.screen('vitalik.eth') const { valid } = await od.verifyAttestation(r) // true / false, checked locally

Rotation policy

Keys can be rotated — for scheduled hygiene, or immediately if a key is ever suspected of exposure. When a key rotates, the old key ID is retired but never deleted from this record: attestations it signed in the past remain independently verifiable forever, because the retired public key stays published below. A signature doesn't expire when the key rotates; only new signing moves to the new key.

Each key ID appears here with its activation date and, once retired, its retirement date.
Retired public keys stay published so historical attestations verify indefinitely.
On suspected exposure, rotation is immediate and the compromised key is marked retired the same day.
The key_id travels inside every attestation, so a verifier always knows which published key to check against.

Key history

Loading key history…

Maintaining this log. This history is currently seeded from the live key endpoint (the active key). When you rotate for the first time, add the retired key here as a static row — its key ID, PEM, activation and retirement dates — so its past attestations stay verifiable. Keeping this list by hand is deliberate: the record of what signed your compliance evidence should change only through an explicit, visible edit.

System status → API documentation →