Recent entries

Checking a card

Each card carries the hash that was signed, the signature, and the public key that made it. Those three are enough to check the signature yourself, with any Ed25519 library:

const msg = hexToBytes(Event id from the card);
const sig = hexToBytes(Signature from the card);
const key = await crypto.subtle.importKey(
  'raw', hexToBytes(Author key), 'Ed25519', true, ['verify']);

await crypto.subtle.verify('Ed25519', key, sig, msg);   // true

head_event_id, as 32 raw bytes (hex-decode it) No prefix, no context string, no second hash at the signing step.

What that proves: the holder of author_key signed this event id

What it does not prove: that these fields are the content behind that id — that requires recomputing SHA-256(canon_event(content)), which needs the canon, not a browser The format is published.

The node verifies with verify_strict, which rejects non-canonical signatures. A stock library accepts a superset, so it returns true for every legitimate card here. The difference matters to someone constructing a variant, not to someone checking one.