Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“bcs u cant just download normally u have to pay”
Google Play · 2/5 · 2026-08-31

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 2683258276

Proof data

Record hash (SHA-256): 3614314c7d415fc05dc9b832b48746ac9ebf4ebb2297759d3dc1afcd69e2c913
Signature (Ed25519, base64): HXr0Cw5Us5yEP+jsVmr2KHITtY5C7u0osBRAlgS0dClPgtlNqo/GWw0o9muJ0JNdpar7s5wqAOqJK965BZbmBQ==
Merkle root: 1b4480a4fbb367e76fd34ca26880b5c46171f974cf3a94f9b036b42e01723c56
Merkle path: ["361399db69040eef756c34e353c5df074936791398aaa8cffb29d1f8a63f9bde","3d43a03724fbae8dff09f918aad4b2fcc7b74704f74a17cb3ceaa1e98d688554","03de255c5cbf4e698348f0c4521cfd9a782f05b6c226d6a8df92c17fb0fd7b7c","810d1fabbd0d2c6c24d14f03ba949febeb7dacb77412019252532ba3db56678b","320f1ce8938654f8a38a80a5e410d12e53b8b824a4cf62fb260dade37f017ec0","3701f7fc5677c8b4b82a610366db94522b595acfa1cc8849113855d5d418b250","b4b4ff2508e68491f3cb853f7769528eaf395626b3fb0364ecfd22582431b713","c5c704fd7ec7dbad3c8d057595461aaedcac67f0183d2ebcb10a55b7c2851606","7a766b101e7a959eb27bc2956192a739157b1a646d7579f43873de69edabee39","8c9c47ef779345beca6af83492439fcbb52df29c607d69918d6332fbd4916e50","143a7e1ea20bf5df1fba8b9ef6128f2f8152b6e598796581e27cea41948f2aa9","7a3d724d805a5f7702fcfd47a2478813d5361ab52c93ab520fd3692c70240ac1","05a90d241075e7f4c50bbe0b0ba3995ced328afb6f26ba9b8d7006707d1d2290","e7218144e850bd19a6bceecc50f33cdd16123e2542b211b07ffe285b3602d2d5","26c4d515b1da79ddf02519980ecbc6a7fec0326ec612e5f075735f461991082a"]
Anchored: 2026-09-02
Public log entry: search.sigstore.dev, log index 2683258276 · entry 108e9186e8c5677a44df…
Expected log hash: eeb02f3fc88cc5ba2c672023b294d6863b311c6353fa3c9c8dfe9c0b1e584208 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1788322016973","kind":"published-quote","locale":"en","page":"brand:canva","quote":"bcs u cant just download normally u have to pay","rating":2,"review_date":"2026-08-31","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.canva.editor","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (1b4480a4fbb3…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.