Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Besser als Google Authenticator.”
Google Play · 5/5 · 2026-08-05

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 2657305914

Proof data

Record hash (SHA-256): 0a1c95176b5e55292b297951b0f96b5723b0d11ed7c18037f7f9fc2c80a6b22f
Signature (Ed25519, base64): Gqabbm51Gy5GrN9lU7Oxeh8i6zzgrDOy01FSthk56I/Qn1UfJEr4My5TpoWL+7mSVSmwNwWfGGEA1AsyjqSyBQ==
Merkle root: 4e4bd1a263431190e24045d88fbbb7ed5f9030935faef80dec659ae2f039ec76
Merkle path: ["0a1250ca38005b593fe29aa53ce22706fa8021a07336288312d9f081f612f545","6bc26bc15713dff58d1bb8e9a7034791955359c87d002b9de42cee877d10de1f","055937c1d0932fdc2baf607353210aa5bedda542a0011245f35f3e0ae19910ee","04dd5b009befbdd96314d40a777b6df0a660c80cbd5b5b8796a90ff8d6b16f26","6e72024d9277a789e62cee4a0566d8b093979ca1cd48d8020511383d408fdc94","87c30e9f44c140a9ff1819b0a53bd7bc2ac3acc49af6dbce4a2b3c7f6fb70e17","d6913a6ef7f7fc9c20bb99411ebc4f46f73d965ff89ae2e6b95df25c9a4e4cf6","36c158d425a58c0165171d960ba32c8e9693278205ec869eb2bdd302ed05a004","9e8da8906c17d92c66aa66b51f905e9a93a8d63bac21fc85cd03304cacab92a8","6cbec580302ed2376baadd0c20822097ac8f42280baf08c887a8c868295292e8","235867b62f3d23e43a13221f4c67536622a627c210244f0fead5d705ff5c733b","2ba87cf098c6c2404b2a7976747e04faae5f4c59da8677168f10303f3103cbb8","0dca924cc5d490cd09e6cf28d263a70ef1171963dfece74286d6f33a3bb659d3","5b404d681bffee559c59320e4c89c61c29c9a49c6b4ba6d76cd832716684aa58","9aec3ad04e3d8c78958d9259e35fb1f1ff0ef798a114433bf3a500e8a57b1e41"]
Anchored: 2026-08-31
Public log entry: search.sigstore.dev, log index 2657305914 · entry 108e9186e8c5677a8c0a…
Expected log hash: 706e8c400fa8ee9f8b3984ef9db59f211ad2980d864551783fb16e1211d62156 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1788144640122","kind":"published-quote","locale":"de","page":"product:proton/proton-authenticator/de","quote":"Besser als Google Authenticator.","rating":5,"review_date":"2026-08-05","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=proton.android.authenticator","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (4e4bd1a26343…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.