Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“hardly any setup required”
Google Play · 5/5 · 2026-08-13

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 2647299953

Proof data

Record hash (SHA-256): 06c5fea836de6e129dd0dd0dd570bbcefcdf60d25b33f381d76724a21591c3e8
Signature (Ed25519, base64): FGLjYsx5toga3ZLncaOoBRheFQEFZUxxeZV2PlBbGyE2622Hsz+e7mTTdgYbI0YpPsrXqcYTvIxi/UE2zlN4Cw==
Merkle root: e650e75fd77078528aa305533eee5d0a1a546628fc8516773e724c8dbfd143b3
Merkle path: ["06c98a118714d6855a88c932a6a7f85c11d4611a8617be01b16d3237e22e108b","8b4fa54427627db1a6364dd58e58f931cf4c69144da46f3cecc8990e5d16d939","243b4c5ad0282232d85dd9f9b5e104ea656e4d9c66c8a267de36e40d17991eb5","f3a422d9658dd0ecba6d75df13a79775e6406836c0793a5017dce569934cbaf2","fe29c9efd133e8e9ade8d70836b312b351fbd21e39578c4c860845d2dea95be7","c5e66da88294505dd5df8a132544e25f9d2ce8f9f9f07745d71faa4ceabbc558","5e874c4ea6f55865b2a48856cd21a96aca3a34ad43de6e12f305613d35316fd7","7a05b0af6a39a5c4786e091dfd8330f2a4ec2ff782dd5af93e8249a41b936941","e0b84f57fb2860be91e416a32da8a9b1802adcab01ec75b8fa002c577a59f4d7","990a175807201d3243142bc77255ce1e9e5bcb1b0c14f38e5e2308588630a301","d091556122043933f3541ce9698baf36c60a2bddf02ac0e7aec614d9f6274e7a","9cbfd3204b3e2f5027edc155e8333a2328120eaa38808f017553940b835c0837","03229a02d4ef23689ac574ce2fdb2e91509dccaab3854dbfc8d9e90af4ef8953","de4b01acb55e434b8077712a3cea8899c69e63005b6b5c436594f06bca9b060d","bd662811507e1e874bc6ba02d614a311af652dab0714938ac7c98aadfaf42cae"]
Anchored: 2026-08-30
Public log entry: search.sigstore.dev, log index 2647299953 · entry 108e9186e8c5677a1824…
Expected log hash: d76177f6a64b24e24552f49a73f627dcd7dc14dd72da9a30f95c027c24a50fd8 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1788057950482","kind":"published-quote","locale":"en","page":"subtheme:proton/ordering/setup-configuration/en","quote":"hardly any setup required","rating":5,"review_date":"2026-08-13","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=proton.android.pass","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (e650e75fd770…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.