Public signing keys

Verify SparkIN certificates offline: hash the canonical payload, then check the Ed25519 signature against the key id printed on the certificate. Also served as JSON at /.well-known/sparkin-keys.json.

Key id	Active from	Active to	Public key	Status
`k-2026-02`	11/09/2026	—	`3zE5y0qGWt…xUw=`	Active
`k-2026-01`	10/09/2026	11/09/2026	`abpbeuRZSe…zZs=`	Retired — still verifies

Keys are shown as the base64 body of a PEM “PUBLIC KEY” (SubjectPublicKeyInfo), ready for OpenSSL or any Ed25519 library.

GET /.well-known/sparkin-keys.json

{
    "keys": [
        {
            "kid": "k-2026-02",
            "alg": "ED25519",
            "kty": "OKP",
            "crv": "Ed25519",
            "x": "3zE5y0qGWt-mlk-hWxyOaVhAoWTumycrN7fIQlP0xUw",
            "status": "ACTIVE",
            "active_from": "2026-09-11 13:22:50.118",
            "active_to": null
        },
        {
            "kid": "k-2026-01",
            "alg": "ED25519",
            "kty": "OKP",
            "crv": "Ed25519",
            "x": "abpbeuRZSeDRE3P424nqL659VqxF6sYpzM7c86eGzZs",
            "status": "RETIRED",
            "active_from": "2026-09-10 18:22:11.540",
            "active_to": "2026-09-11 13:22:50.118"
        }
    ],
    "about": "Ed25519 detached signatures over sha256(canonical payload)."
}