Signing Keys & Transparency Log
Receipt seals and chain anchors are signed with an HMAC-SHA256 key. Rotation mints a new active key and retires the previous one — retired keys stay in the keyring so historical receipts remain verifiable without re-sealing any evidence. Publishing the chain head to the append-only log gives a timestamped, independently checkable record of the audit history.
Signing keyring
One active key signs new receipts; retired keys verify historical ones
- No key minted yet. The first key is generated automatically the next time an export is sealed, or rotate now to mint one.
Secrets stay on this workstation in the demo console; in deployment the same keyring is held in an HSM/KMS and only fingerprints appear in reports. Losing every key does not invalidate past evidence — the hash chain still re-derives — but signature verification needs the backup bundle.
Public anchoring — transparency log
Append-only Merkle log of published chain heads with inclusion proofs and signed tree heads
- Nothing published yet. Publishing is optional — it lets an external party confirm the audit history existed in this exact state at a given time, without seeing the records.