Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Emails only arrive from certain mail servers.”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
1da3b8c75a8a03970bcbbe429cfa8ce89227db8abd95b3b255e6954a8e831d07
Signature (Ed25519, base64)
AowdtELkvZruyF5O+sLZQjJ7gXqmGgDuc+ak3Suoj1nBGkSKtgbgyIZ8dRtO17di+nmGpM1nmpF3q/9BvBUkCA==
Merkle root
8552de27836d9c1d73f2670cf2bc11df6459e7443d47ace4674278484e3a6d8e
Merkle path
["1da2082872e2f7c969ad0e8c469b894f8c2bc969b3d989445ee2f3335d9954f5","cedd84458c353d326cbd6ddf156ab47ebb89e5bc43d72770e7039ed04525b255","8494fd648eff710720f6955611b3b1c37cccf903c0368e2c06c712640cab924f","64fda6220ca53d8e8a3eda45b3eea514e1259e67c2d1c2e805688b84ec4d93af","71016e3a09c48d578a465cfebd4e78e2c0f3a71d1cbe0b675ed8fe40b8260cf3","b016db8f380d91491364017b106f980bd7c88cec90b2feab76ccd1c0467acc49","8de1f997ef5b25199a5b28ec6715030ca6e9efd59c800018131a231d5b1ed93f","a7fbbf2684d683c70dcb644f0cf2b9265f2c35f395f4ccbf03308f921c2e1c8e","b50bb0ca71d68c4f4738ad83f21fa8ff46e02d5fffcbb5bcdbb1afdb9a5a3b72","a2167604f39dde688faee94cbc75887b7dd0f34620ca58d2a04f03684dea1105","4f17a7ed38c98f7a470320811cda3089cdb974f325cd6f8590ff2ad504addacf","521a2de35e4b98beb07bc39254cf192902ab2b5298a659e0538f167d5630eb48","06f625e80da47a14c2d3e7027b88f7f89c63e459e05ddda58b98e60b36bc2518"]
Anchored
2026-11-03
Public log entry
search.sigstore.dev, log index 3668793196 · entry 108e9186e8c5677a8c91…
Expected log hash
f099839a063ebfd0b66050d615b9645cca5be77075ecec449f1aa0148fdcbfea The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1793706932685","kind":"published-quote","locale":"en","page":"brand:tuta","quote":"Emails only arrive from certain mail servers.","rating":1,"review_date":"2026-08-21","source":"Apple App Store","source_url":"https://apps.apple.com/pl/app/id922429609?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (8552de27836d…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.