Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Je suis très déçu car cette application a débité mon compte de 399,90 ₱ sans ma permission ni mon autorisation.”
Google Play · 5/5 · 2026-08-12

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 2525010456

Proof data

Record hash (SHA-256): 4000c79fb0ef73ec4a38484492442d8879d94d00787e863fef5a79153b463246
Signature (Ed25519, base64): 0/Il6qGmi7saIPasx8AamKp3I0jrdTHEQSu3A6543qkiyysPbK9ShMjJMNc/DsnlrNXRDtqPvmxda2wl7ANAAQ==
Merkle root: c69b412346f0db8d88aed17dbaf2e4876a3743c1c4d16fb306ba56b5c0573123
Merkle path: ["3fffe98b065033000975be37372af93ad1405ab4c9c28b3e0563fbb0c5eeea26","c88eedb7095792546828caadb80e895641422a840f830711130d1052e5326447","9685dd69e2a18bd93f7d21c016f88eee3605e854fc315a28530c9934b31baee0","6d0fdec76d46bad56db7ce9164c489af3027fe6ee75fe80723807c575a59ab2e","83e4ebb4890f5251ee2a109e90827d9b440fb9ecb0adf8ba34af3dc87feadbf0","4c5df73c748b605f584b9893ea0c9ae2f8846e565289dd2ad50e8e0e21e40822","91d320bd04b4ae078d4e6abc07b3127ae2037cc099b184e1977e43ca5bd7a1a0","1be776893c7ad75b8cdb21e8e0544e680711d428d9f2820f976bd751d07964cc","4c7f6f38fd587701bd205c4c61500db8c96fdf7423cb8ab5fc92521cf49ca420","5370cb7909b56d29f0feecbccca8c6f92e295c2a921e4f06055a9757793a33b7","1ad4af6caaf97ea6aa4e6e68d13e07b350047e95146effbdb504ab065eb218a1","6bc505cec9cfa6c65890bf4e5567a5e9c41915dc5198970e3883c998d4888fbc","2902401036646228e991cedada72ba594212cade8227204cfe8c0e390674d7b1","62927e8f71080777dd1935c21221e60b742dc0377a31e2f20a0a64cf6c3282e8","3da38b679e2392986aef224a332d14750fb3a22c4e75287765e8f68f575f24f3"]
Anchored: 2026-08-20
Public log entry: search.sigstore.dev, log index 2525010456 · entry 108e9186e8c5677a4287…
Expected log hash: 659be4fcc7663b2dc65a53351e16497fea44ed9ec8aef1f3c48c8e452b350dc6 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1787194832011","kind":"published-quote","locale":"fr","page":"theme:proton/billing/fr","quote":"Je suis très déçu car cette application a débité mon compte de 399,90 ₱ sans ma permission ni mon autorisation.","rating":5,"review_date":"2026-08-12","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=ch.protonvpn.android","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (c69b412346f0…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.