Examiner Infrastructure

Key Ceremony Helper

Generate an Ed25519 did:key, sign a §27.1 role-binding record naming who holds it, and print a dual-control key-custody record. This is the onboarding step for §27 human accountability — the record this page produces is the same shape the Verification Desk and Verify tool check.

⚠ A did:key is a self-asserted identity binding: it proves control of a private key, not who a person is in the physical world. Pair the printed custody record with your own out-of-band identity check (in person, notarized, or a vLEI/ACDC anchor) before treating a role_binding as trustworthy.

Zero egress, zero storage. This page makes no fetch/XHR/WebSocket calls (its Content-Security-Policy sets connect-src 'none') and writes nothing to localStorage, sessionStorage, IndexedDB, or a cookie. The private key exists only as an unextractable in-memory CryptoKey in this browser tab and is discarded the moment you close or reload it.

Client-Side Zero PII Key Never Leaves Browser Print-Ready

🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.

Step 1: Generate a did:key

To round-trip this record: copy the signed JSON above, wrap it in an array [ ... ] if it isn't already, and paste it into the Verification Desk's "…or paste JSON directly" box, or into Verify's §27 tab. It should report as a conformant role_binding record.