Trust & provenance

This site's authenticity is independently verifiable — identity, keys, signatures, and privacy posture in one place, and checkable live in your own browser.

Verifiable identity and publication history

Each version of the did:webvh 1.0 identity is preserved in a signed, append-only log, allowing historical resolution and verification of authorized key changes. A separate three-version rotation demonstration shows the original key authorizing its replacement, followed by an update signed by the new key. Builds verify the logs with TypeScript and an independent Python implementation.

The publication statement receives an inclusion receipt from the SCITT transparency service operated by Blackcat Informatics. The publisher and log share an operator. Receipts establish registration and byte integrity; they do not establish factual truth or independent endorsement. The service publishes its registration policy, trust anchors, signed tree roots, inclusion proofs and consistency proofs. Architecture: RFC 9943. Receipts: RFC 9942. The SCRAPI interface follows draft-11, which remains a draft.

Choose “Verify this publication” in the evidence browser to verify identity history and the receipt. Scheduled check status reports the last attempt, last success and staleness: identity, receipts and history continuity hourly; MCP, A2A, skills, owner isolation, three languages and exact passages daily.

What these checks prove — and don't

These checks prove that downloaded artifacts match published hashes, signed artifacts verify against the published artifact-signing OpenPGP key, and the provenance manifest verifies against the published Ed25519 key. They do not prove that every biographical claim is externally verified, nor do they replace independent verification of third-party profiles.

Identity

• did:web:patrickaudley.com — decentralized identifier (/.well-known/did.json)
• /.well-known/webfinger — WebFinger
• /.well-known/nostr.json — Nostr NIP-05
• Ethereum / ENS identity: patrickaudley.com · 0x3FEFC1B6D9b6A851bfC274fEa1929c31c6F23cf2 · did:pkh:eip155:1:0x3FEFC1B6D9b6A851bfC274fEa1929c31c6F23cf2

Keys & encryption

The site publishes a long-term PGP identity key, a separate OpenPGP artifact-signing key, and an Ed25519 key for its provenance manifest. HTTP response signatures are not currently emitted.

• OpenPGP public key: /.well-known/pgp.txt · WKD (/.well-known/openpgpkey/)
  DF3B 3209 EEDB 36C8 00F0 9C1F 1712 C2A1 55DF 887E
• Artifact-signing key: /pgp/github-signing.asc
AF5E 0032 F749 4CEB CAA7 BBBE 9B87 CFBB CFDB AF11
• Ed25519 signing-key directory: /.well-known/http-message-signatures-directory (RFC 9421)
• Published key inventory: /.well-known/keys.txt
• The key is also discoverable via DNS — a DNSSEC-signed OPENPGPKEY record (RFC 7929, under _openpgpkey) for DANE discovery.
• Key continuity: signed transition statement · email-identity audit (RFC 3161 timestamped)

Signed artifacts & content provenance

• Signed resources carry detached OpenPGP signatures (.asc); the manifest is at /.well-known/manifest.txt.
• Custom content-provenance manifest (SHA-256 and EdDSA JWS; not C2PA): /.well-known/content-provenance.json

Verification recipes

Import the published key, verify a signed artifact, then inspect provenance:

# inspect the key's fingerprint BEFORE importing — compare it to the one above
curl -s https://patrickaudley.com/pgp/github-signing.asc | gpg --import-options show-only --with-fingerprint --import

# then import, fetch a signed artifact + its signature, and verify
curl -s https://patrickaudley.com/pgp/github-signing.asc | gpg --import
curl -sO https://patrickaudley.com/llms.txt
curl -sO https://patrickaudley.com/llms.txt.asc
gpg --verify llms.txt.asc llms.txt

curl -s https://patrickaudley.com/.well-known/content-provenance.json | jq '.subjects[].sha256'

Page integrity

• This page's scripts and styles are pinned with SRI hashes (the live check above recomputes and compares them).
• Build: e7289c0 · generated 2026-09-28T12:27:29-06:00

Security contact

• /.well-known/security.txt — RFC 9116 (expires 2027-09-28T12:27:29-06:00)
• Secure / encrypted channel: secure@blackcatinformatics.ca

Privacy posture

• The site honours the GPC (Global Privacy Control) signal: /.well-known/gpc.json
• No cookies, no analytics, no third-party trackers; server logs are kept for security and capacity only.
• Privacy enquiries: secure@blackcatinformatics.ca · Legal & privacy

Mail & transport security (DNS)

Published records for patrickaudley.com (the live check fetches them via DNS-over-HTTPS):

MTA-STS policy

Standards index