Certificate signatures
How signature verification works.
Signed metadata
Certificate-critical fields are canonicalized and signed with the registry Ed25519 key at issue time.
PDF fingerprint
The issued PDF stores a SHA-256 fingerprint. Public pages display a short form for human comparison.
Public keys
Retired public keys remain available so old certificates can still be checked after key rotation.
Corrections
Certificate-critical corrections use revoke, reissue, or supersede workflows. Records are not silently mutated.