● Active keyEd25519 · Alpha signing identityActivated 31 August 2026 · No revocation recorded
Official key fingerprint
Compare the complete value. Do not use a fingerprint copied from the report bundle itself.
sha256:378b727cc2d09216f5e3facc0b2292dfc5748cf7fac59aba90e1f9a75ec0716eVerify with the official key
curl -fsS https://www.pythonbackendrescue.com/.well-known/production-7-report-signing-public.pem \
-o production-7-public-key.pem
p7 verify-bundle report.p7.zip \
--public-key production-7-public-key.pemA successful authenticated check begins with VALID TRUSTED followed by the fingerprint shown above.
Understand the result
- VALID TRUSTED: the report is unchanged and its signing key matches this independently published key.
- VALID SELF-CONTAINED: the files agree internally, but the signer's identity has not been authenticated.
- Any verification error: do not rely on the report.
Scope of the proof
A valid signature proves report integrity and signer-key possession. It does not prove that the underlying evidence was truthful, that every relevant risk was discovered or that the inspected system is certified.