Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“Why do I need to download an app just to log into my account?”
Google Play · 1/5 · 2026-09-05

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 2789279696

Proof data

Record hash (SHA-256): 7d71cd0ccae699d81592b108b75c9f190e65b6e8f04ed8c48123b377de1ff71c
Signature (Ed25519, base64): N7tWanKe3GlN20FPFps7r+k8MK1v29DV7U4Baz9IlnfKx7SCNXD9gSwjdqmp7GjSOL1JVDxNBtqw1Jd4Y4QpDg==
Merkle root: 97eb1062a862b99998bef0a84476eb3c3812bb77c2cb927f4fd2933b59da9e3d
Merkle path: ["7d69f2202a0ce8877cc36fd3788a831b5f1ff65b8bd6b7b335d66a594f2f032c","c07591ce56900163d206f082a9a7f667c85741a8a6d99c448e9737058e1bc542","073d280c7f14d6975976ddc003f1e9ef41a949d96deb48349d807819127cc480","272aec3984badec015d860bf8386b2171357fa17f4ad6ce9c9142c639c729553","3225e84e17450d400d7324d8c450f4627dabbb71a8cc289c1e8f579b42b049ca","205e66c7431521028e5836bb09ae664606ca1d8c123471c539e47079c2d036da","c5bde4d6380dd9123fb6b1dcd0e853c200dceba1a13f45c8a19d1770622f37ae","fee8d8a0317463d862c64bf6a8482521d9324d0c849bca9c3f08b575e4a96d98","92f7117612021e3adbd40c532fa5e96c6655a0dabe48bf741b61f9fc8b174827","2d8ecb41f8400c70f915406462ee47efc269e681ddb12759aa75be7bb6a1c1b3","4a7da3ae635c518c772181747583fe91b52dc970a195f2fea0b029288d95f308","ed5206c0018c25fc911a5b83d48a4b07edf1ca07ade25d7e56162349167c269c","6772a6b2cfb742f4baa103e424787f6ab6a8cbdfc294db886f1451f7c9752077","90e3c3ed08ff9f4dee6683cf95bfff311f4715cac07e97ca75ea5b9bcf13efe4","01242865574478f13dcf9d888236d7a907264abdb87f360db7db06de0945075a"]
Anchored: 2026-09-11
Public log entry: search.sigstore.dev, log index 2789279696 · entry 108e9186e8c5677a3885…
Expected log hash: 05c7009ecf7ce5cf315c252c2a1dd135e64989a02cacdaaa3c5a87412a2e921c The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1789017464005","kind":"published-quote","locale":"en","page":"brand:xero","quote":"Why do I need to download an app just to log into my account?","rating":1,"review_date":"2026-09-05","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.xero.authenticator","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (97eb1062a862…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.