Verify Documentation

Verification flow

1. Obtain a complete AttestLayer package ZIP or open an applicable public verification record.
2. For a Buyer Review Pack, the verifier checks every manifest-covered file, the canonical manifest SHA-256, and the Ed25519 signed receipt.
3. The receipt key identifier must resolve to an applicable issuer key from a dated, separately published key source. A package-supplied key is not its own trust source. A package is not recorded in a public log.
4. A successful result establishes package integrity and receipt authenticity. A failed or incomplete result identifies the check that did not pass.

Verification proves the files are unaltered since issue and were signed by our published key. It does not prove the answers are true, and it is not a certification or an audit opinion; your organization decides that.

Key sources

• Issuer-key discovery: https://registry.attestlayer.com/v1/jwks/issuer.jwks.json. Record its source and retrieval time with the verification result.
• Registry public-key routes may be used as trust inputs. A package is not recorded in a public log.

A package is not recorded in a public log. Verification checks that the files have not changed since we issued them and that AttestLayer signed them, using our published signing keys. It does not prove that the answers are true.

Signing keys

• The Registry publishes issuer public keys for entries deliberately recorded through the Registry path.
• Receipt verification uses a separately obtained issuer JWKS. A package is not recorded in a public log.
• Retired proof routes answer 410. No proof result should be inferred.
• External witnessing and external anchoring are not active.
• The legacy registry-wide verify-kit download is retired. Use the complete package and its verification instructions with the hosted verifier.

The Registry is record-only. It does not opine on the substance of underlying records. A package is not recorded in a public log.

What an integrity result does not mean

• A verified package-integrity result does not certify the substance of any business claim.
• A verified package-integrity result does not imply endorsement, mandate, or approval by any bank, insurer, payment service provider, regulator, government body, platform, or institution.
• A verified package-integrity result does not replace separate legal, procurement, audit, or compliance review.