Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“spend a load of cash to get friends and family on this”
Google Play · 1/5 · 2026-06-19

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 3124493015

Proof data

Record hash (SHA-256): 0e52583c3c390ad0a5c0192ed64583736755fe814d8a6bbc865363f7b26c7816
Signature (Ed25519, base64): AxqQMST+qxJnYskKWGPunFgOAn8gcobGgNEUEu4OnnSJEkWwVIqebErta5epii7/4W0B+cgmGKbCfjZ8OsUmCw==
Merkle root: c481d62412848235567fda063ff4784e8e49df41ad8b5c570de24ba396415d22
Merkle path: ["0e513f93712da8cbb820262d726b4b5e0b320dbe8255dd7f2ed605e8da0d866a","fb8d8460d7edac2fe1264c380c3b5e4cdd3f4f0165349035fdfd59963769a213","d36a1ec8c3dee9c75a83b2c5fdd68cfa8d1ce62ff29f37fcb64c3b67f8d8d94c","a4fb0c63e2c858d1be05744fba6d84a6534c5a3eb63c2dd00599b08efb607d16","b482c84d0315c00d3e3e52420a3b90c088ced72c37dbc1e7692eff281e6ab302","2c4c940e2e7bb0c598f19e73828c550b8477127cdecf3370b9d7208eb45487d0","2174e7660d4b7c68846e425daa4864a15d685042b8526ab8199e18e8283c4075","997cc5eac7140c99183790d49cfd25eb640cdad4d48159ef66133f5cc3287b05","28b74f9afbc6471cb8a4ca08ae0616e3805bceb25bb9ff152b955ab99bf2bb21","344d1004ecd63c52a48e03981036ea37e7fb45afaa040869e7e21ad3d642c8df","9ca821772c9bdad98e12eb64e11574220c9ced0407a8412a20a61baa3cc69ced","1e420c13b7798af08501fbe6365ddc5b44e5ea7ed3d656d15db245d747c77a23","818f0135095488afaa32256706f222f09138af7de4410ea79d618f621eaf5cb2","ed99a4b837bfc052822e7d0dbdd9c56431a87e8600550f5deaf9f7068616c82e","0cbfc145d581a4c4b7198ff8f397c34cb4ba6263e9e9892372f878302426dbe6"]
Anchored: 2026-10-07
Public log entry: search.sigstore.dev, log index 3124493015 · entry 108e9186e8c5677aee70…
Expected log hash: 0056b042c00529af1248b70a0a2fbed761990dd7841ea722369c29a2685ea6e1 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1791350987184","kind":"published-quote","locale":"en","page":"brand:threema","quote":"spend a load of cash to get friends and family on this","rating":1,"review_date":"2026-06-19","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=ch.threema.app","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (c481d6241284…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.