{
  "schema": "arcaeon-signing-keys/1",
  "issuer": "arcaeon.io",
  "description": "Ed25519 public keys used to sign Arcaeon Verified Snapshot records. A snapshot record carries the public key that signed it, which shows the record has not been altered since signing. Comparing that key against this list is the separate step that shows the record came from Arcaeon.",
  "matching": "Compare key bytes, not labels. Records encode public_key as hex; this document uses base64. The base64 public_key field is normative; public_key_hex is the same bytes, provided for eye comparison against a record.",
  "status_meaning": {
    "active": "currently used for signing; trusted",
    "retired": "rotated out on schedule; records it signed while current remain trusted",
    "revoked": "withdrawn; do not trust records signed by this key"
  },
  "rotation": "Rotation adds a new key with status active and moves the previous key to retired, so records signed before the rotation keep verifying. A key is only marked revoked if its private half is believed exposed, which invalidates everything it signed. This document is the single place either change is announced.",
  "verify": "https://arcaeon.io/verify",
  "updated": "2026-09-05",
  "keys": [
    {
      "key_id": "arcaeon-snapshot-2026-08",
      "public_key": "TQpBViAsAPrt9Z8BjdgH77vNftfbqkNylOtuxYawT+o=",
      "public_key_hex": "4d0a4156202c00faedf59f018dd807efbbcd7ed7dbaa437294eb6ec586b04fea",
      "algorithm": "ed25519",
      "use": "arcaeon-verified-snapshot",
      "valid_from": "2026-08-12",
      "status": "active"
    },
    {
      "purpose": "mcp_vet_receipt",
      "did_key": "did:key:z6MknfStpcV9daPvTzwRPXADV1JozzfCwRFvJ52mSdhxDdjk",
      "public_key": "efy7XapxIYzq4PzmIhmpEsOVkPyLQnnPDcBHsToeoY8=",
      "public_key_hex": "79fcbb5daa71218ceae0fce62219a912c39590fc8b4279cf0dc047b13a1ea18f",
      "algorithm": "ed25519",
      "since": "2026-09-05",
      "status": "active",
      "description": "Signs mcp-vet's grade receipts (projects/mcp_vet/mcp_vet/receipts.py). Not a snapshot-signing key -- it is published here so a stranger can verify a receipt's did:key against something other than mcp_vet's own word, not to be trusted as an Arcaeon Verified Snapshot key. Public half only; the signing seed never leaves ~/.velouria-secrets/mcp_vet_receipt_signing.key."
    }
  ]
}