Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“I reached out to Proton, but I have not received any response yet.”
Google Play · 5/5 · 2026-08-12

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 2882354328

Proof data

Record hash (SHA-256): 0c80ced646880f916ba6e64b7f37c4ddf7e58737f2e5c623d780b4b4679458cd
Signature (Ed25519, base64): OllJNDpwdGM+TJJKaxMhbNw2FCPsm6dJ9J2u6YjgxZ0jvu2UkCrq4+zyBI6RqMv/Tc6seM6LFjsvsvLWI0X9Bw==
Merkle root: a893faa173c6b378c8d050262e841ab57fdd89b71985eabc0906c40abd5b6a6c
Merkle path: ["0c7fea7a68fe4c47d2331bf594ec3f9711e12e2d3b81d6e3537e850b0dc3db33","a2ad9a85856aab96da92f906d412c3c398297c375c49f7f3151e4e72af44e542","c961496f715fffbfb6e848b21f474b2f7703eacaed87c40f4cf47eb9a87c24e1","4dc79f910a91870c8126b777f41a623575e1ba68c00c35c2bb1bdf020e6ec78a","5fe24d167fa067f0cfe675556713fb5ad403dad2ce3c06f3756b17ed17e44523","060bf1c694fd7d1d22a4cc239da4a1cabb1a1494b1d153c92b13046ad7155739","4efff86ab5a3798de5329df1c46316a00ea640a5670fe7dcb734f8a0859c0109","57f8c87987751f6e5f9baaef8c6842f9f0d6e5370ccecf10aba2fd9d7897b2da","c50c514e0a2bb12bf8ebc3f0588bba317d8c10c3848fd95ee38f40264f71952d","2fba17a632bd0e32d3df70948fa512af1d6fcce283912fd751a0821642b9253e","d7989a88ac1bbc0beb5f49533be1133e2436d83724dd146628bfc14c39460756","eeb0191e819461d67046e8c9e0ea5e35d219e9b877b9e670c3710c5d41b21c5a","ac84b40c079795f897b874e92b06e183fd354538d22a2dfa07d743913040a0df","71601cbc06cc18d15a7af93021ee7957212de37616a4dedb4252c015daf6350d","5153df72155ae00831ba1e4416296382c39280ea82c989972042c066f445006a"]
Anchored: 2026-09-18
Public log entry: search.sigstore.dev, log index 2882354328 · entry 108e9186e8c5677a08a7…
Expected log hash: 5510a497abfe2e680a39c301b0d905c2a575bae0a1f389fbdd7b86babf05240f The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1789619628558","kind":"published-quote","locale":"en","page":"subtheme:proton/service/support-responsiveness/en","quote":"I reached out to Proton, but I have not received any response yet.","rating":5,"review_date":"2026-08-12","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=ch.protonvpn.android","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (a893faa173c6…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.