{
  "algorithm": "Ed25519",
  "format": "spki-der-base64",
  "public_key": "MCowBQYDK2VwAyEA0xgVbGabWzC1vqj2K8vOtzjSrGT9+8v5v8shc8BpNK8=",
  "signs": "the 'version' field of every published payload",
  "purpose": "Proves a payload originated from Soren. Combined with recomputing the version hash yourself, this gives both integrity (the content is unaltered) and authenticity (it came from us).",
  "how_to_verify": "1. Recompute 'version' from the payload as described in its verification block. 2. Verify signature.value over the ASCII bytes of that version string, using this key. Both must pass.",
  "reference_implementation": "https://soren.com/verify.js",
  "rotation": "If this key is ever rotated the old key stays listed under previous_keys for 90 days, so payloads already in your cache remain verifiable.",
  "previous_keys": []
}