{"schema":"steadywrk.trust-rail-key-registry/v1","generated_at":"2026-08-11T02:07:45.171Z","source":"database","signing_gate":{"key_id":"receipt-chain-ed25519-v1","registered":true,"revoked":false,"armed":true,"meaning":"Issuance will write an Ed25519 signature and its key_id together. Armed is not the same as exercised: a credential must actually be issued for anything to have been signed."},"count":2,"keys":[{"key_id":"ed25519-2026-01","algorithm":"Ed25519","public_key_multibase":"z6MkpqV237C6NYu7gDPLT4cJUKn27TC5jXD32oTYzgQxW7AN","activated_at":"2026-06-09T00:00:00.000Z","revoked_at":null,"active":true,"published_in_did_document":true},{"key_id":"receipt-chain-ed25519-v1","algorithm":"Ed25519","public_key_multibase":"z6MkrYqxNw4PhtnqHLQRjDroEDRCpsz7fuQn6W5sndTSfuqf","activated_at":"2026-08-10T00:00:00.000Z","revoked_at":null,"active":true,"published_in_did_document":true}],"cross_check":{"did_document":"https://steadywrk.app/.well-known/did.json","note":"Every key here with active:true must appear in the DID document, and every verification method there must appear here. A key in one and not the other is a finding — most likely a static fallback being served while this registry is unreadable. The multibase above is the only encoding served; to get SPKI DER, base58btc-decode it, drop the leading 0xed 0x01, and prepend the fixed 12-byte Ed25519 SubjectPublicKeyInfo header.","verifier":"curl -sS https://steadywrk.app/.well-known/did.json -o did.json && node bin/steadywrk.mjs check trust-rail --did did.json"},"does_not_prove":"That a key is registered here says the signing gate is open. It does not say any credential was signed, and it is not evidence that this server holds the matching private half — only a signature verifying against the pinned public key shows that. Read the signature at /api/public/receipt-chain, not this endpoint."}