{"issuer":"oceanalt.com","iss":"https://oceanalt.com","enabled":true,"active_kid":"56b7b21d50cb0c63","keys":[{"key_id":"56b7b21d50cb0c63","kid":"56b7b21d50cb0c63","alg":"Ed25519","public_key_base64":"Xuh0MpnkOKdf08IcKNrtzAULClrutWQbXeEPgH182j0=","format":"raw 32-byte Ed25519 public key, base64","status":"active","not_before":"2026-09-12T06:00:00Z","retired_at":null}],"history_complete":true,"key_policy":{"retention":"Every key OceanAlt has used to sign stays listed here permanently, including retired keys.","retired":"A retired key no longer signs anything new. Signatures it made between not_before and retired_at remain valid evidence and stay verifiable.","receipt_validity_vs_verifiability":"A receipt's expires_at limits when it may be relied on for a new authorization. It does not limit how long its signature can be verified for audit.","key_resolution":"Resolve the JWS kid against this URL only. Ignore any key URL or embedded key carried inside a signed object (jku, x5u, jwk).","rotation":"On rotation the old key's status becomes retired with retired_at set, and the new key appears with not_before. Keys are never deleted."},"usage":"Ed25519-verify the `signature_ed25519.signature` of a decision against its `signed` object, canonicalised as described in `signature_ed25519.verify_hint`.","note":"These keys verify OceanAlt decision responses. Verification is offline: you never need to call OceanAlt to check a decision is genuine and unmodified."}