OpenChainGraph Suite · ART-124 · wave 23

Content Credential Signature Verifier

The in-page runner performs the real signature check (WebCrypto) over a caller-supplied signer public key (JWK) and passes the attested result to the deterministic policy core. Algorithm allowlist: Ed25519, ES256, ES384, PS256. Trust-anchor membership, cert validity window, and revocation status are caller-supplied policy inputs: zero network, no OCSP/CRL fetched. Emits ACCEPT or REFUSE verdict.

C2PA 2.xCOSE_Sign1Ed25519/ES256W3C VC §13.11Zero PIIZero network

🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.

Scope

This page runs the signature check for real, in-browser, using WebCrypto, then calls the proven policy kernel with the outcome attested as the signature_verified input; the kernel takes that attestation as its signature evidence. The caller supplies the signer public key (JWK), the signed bytes, the signature, and the trust posture. Zero network: trust-list and revocation lookups stay caller-side policy inputs.

Trust list context (observed 2026-09-24)

The C2PA Trust List replaced the Interim Trust List as the governing trust list on 2026-01-01, and the conformant certificate authorities listed for early 2026 were DigiCert and SSL.com. This page does not compute trust-list membership: trust_anchor_match stays a caller-supplied policy input. A caller that checked the chain against a specific list can declare its identity in the optional trust_list_id input (MCP callers: the same field inside policy_parameters); the declaration rides the artifact's policy_parameters and is covered by its execution_hash. As of September 2026 this page carries no trust list of its own; check current membership against the C2PA Trust List itself.

Presets

Inputs

Algorithm allowlist

Revocation Status policy input

Trust Anchor Match policy input

Cert Not Expired policy input

Trust List ID optional declared input

Signer Public Key (JWK) JSON object

Signed Bytes (base64) COSE payload

Signature (base64) COSE_Sign1 signature bytes

Signature Verified caller attestation; the runner fills it with the real WebCrypto result

Result

Proof status

Policy proven; signature verification is caller-attested. Full in-guest proof in progress.

Execution Hash & §4 Artifact

SHA-256 execution hash (JCS canonical — RFC 8785):

Chain Handoff → art-125

Signature verdict (ACCEPT/REFUSE) + execution_hash feeds art-125 Provenance Ingredient Tree Resolver as parent_hashes.