Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“you guys aren't listening”

Checks (re-run on this request)

• ✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
• ✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
• ✓ Public transparency log — Sigstore Rekor log index 3124210377

Proof data

Record hash (SHA-256)

8e6563dc5aeb74f61cea2e33ed5829ba07f3da1ce9b75831ac89345823b17908

Signature (Ed25519, base64)

aT3FmKb6m9DxgLjEh+QmHiXzfht9euoyYGlbTYdWCdhLEIF4rUEMG/vu3i1XLOH5xmbe4bkkzZZlLjiI7DT8Dw==

Merkle root

3b820b0e91b2475ca02a79fe65f1dcaac35af570ee21f4c868099b9c17e17c1f

Merkle path

["8e63adb6f352bfa98588fd5ce408dc11b68fbac75ad11d90ce8d99b409559582","56a6b4e6de81b15053787e44f3c1d58c536695c5941e685e220628a14ef0721a","134c8f4c09456e170d09972b2d2cd78f2a4593a79cea8636850c1f34a7461bf7","cb6594399c0c52a6910ad639d21b7b15f821632d21202de1ebc669b63bc3807b","6e3c071f366b94c603560905d597a36e5a7ebda4cccc87435aaab25778086377","60a02be5dba8095fa351f9e330cf8eb0e9b2a9e1d3f9466dc3ec19956e5d6b28","13dbcab6f1677a5ed54614c0240f7af4cec9ea0a41382538a1690beb4d7ac92d","9c9a71097c338d29f940838e3b37ddae9be5969a7d486dca067da81dfb9dea82","45dc5cdd7e1e76179e21f00af800252b4dff75472048ebe16c10ab90994d1902","2df31aa3309d8c938f828f517623b1f5e57ee20adbd1c3ed075f2167fb79748b","2dd7c932a16b693260526fc2447dc6f412cf40aa69ac5e1deb0223c56600f9f7","2d343add7d6c445de4039fab2805e7b3615704f7c464b69b8c43459c7d961350","92dc205e4aa0fc1885d50120ca1ca6d484aa433fa7e4e33e903a12548dc38060","faf75fd6bb73a751917db6b8d00819eae7e29d2bb6f9270942a28e0da8dab05b","92de2c105ee268f1f08dcd9d0a8fc946130cef7b39b15a2b5ed0d7209687c9ac"]

Anchored

2026-10-07

Public log entry

search.sigstore.dev, log index 3124210377 · entry 108e9186e8c5677a0172…

Expected log hash

20a5241ced0c7b94303a7b8002f1aae217df3f1371aea54ff5745a148bddda47 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.

Canonical record

{"dataset_version":"v1791349684588","kind":"published-quote","locale":"en","page":"theme:bitwarden/service/en","quote":"you guys aren't listening","rating":1,"review_date":"2026-08-25","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.bitwarden.authenticator","v":1}

Verify in the public log

1. Open the Rekor entry (pre-filled with this proof's log index).
2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (3b820b0e91b2…), which ties this proof's root to the log entry.
3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.