{
  "algorithm": "ed25519",
  "public_key_base64": "25o4XFpA6r7YaqC0n+uOpMpAxcp/bNezdikqAoX/kf4=",
  "purpose": "Signs every response from the Kairos Signal data API so a caller holds a verifiable receipt of what was served, and when.",
  "headers": {
    "X-Kairos-Timestamp": "RFC3339 UTC timestamp included in the signed payload",
    "X-Kairos-Signature": "ed25519:<base64 signature>"
  },
  "signed_payload": "kairos-signal-v1|<sha256-hex of the response body>|<X-Kairos-Timestamp>|<request path>",
  "verify_example": "python3 -c \"import base64,hashlib;from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey;body=open('resp.json','rb').read();msg=b'kairos-signal-v1|'+hashlib.sha256(body).hexdigest().encode()+b'|'+TS+b'|'+PATH;Ed25519PublicKey.from_public_bytes(base64.b64decode(PUB)).verify(base64.b64decode(SIG),msg)\"",
  "note": "This key signs statements, never transactions. It is separate from any payment address and cannot move funds.",
  "rotated_at": "2026-08-25T10:39:24Z"
}