Signature verification

Every canonical feed update is an independently signed envelope.

Verification has two layers:

1. Marking authority signs the feed-key certificate.
2. The certified feed key signs each canonical update.

Fetch trust material:

curl https://api.marking.fyi/.well-known/marking.json

Then verify:

• certificate signature;
• certificate validity window;
• feed authorization;
• revocation status;
• update signature;
• payload feed ID and freshness.

The canonical payload is deterministic. Consumers should canonicalize the payload exactly before verifying the signature.

Minimal acceptance checklist

An automated consumer should reject an update if:

• the envelope signature is invalid;
• the feed key is not certified by a trusted Marking authority;
• the feed key is revoked or expired;
• the certificate is not authorized for that feed;
• the update is stale for the consumer’s policy;
• the update breaks signed sequence continuity and cannot be replayed/resynced.