Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“keine zu authorisierende Zahlungen”
Google Play · 1/5 · 2026-07-12

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 2483496382

Proof data

Record hash (SHA-256): 9e0372cfd2125c0831238865813cabe544753dd44239c249f1b270e535702949
Signature (Ed25519, base64): Mg0PJfwYx8UxkL22PwKlj9M9bz7pLvOqec7CDbkb5atzyn1dQ/VJEO2TsUCuzXIs9vDwWXA0rzh79bdvvMpaDA==
Merkle root: 8b5970f4b146530c341d90a6af2810c5e81de90ff6866f5f7ab1feb7b3b58339
Merkle path: ["9e01be1885bbbd18550cf294dbe630ffe93651773197d39165eebba5eb891133","4b59e8be29e2931c95a14a5ce07a534279b56ffafaa1cc8924518bc905bccb0d","8adc1e90aea24cebf3cc2fb11854997176a51bad566cf9dcd4e279468ae35ff4","ea4bcbad6f123c8630aeb2eec16cff7d4322f58b1240fae574b9a0e88c63a8d0","6d3f681145e18b63a196cd21494fcfbef9cdcc47e45b20a75c700e2766dc7fd8","cb8d00d8d26670c5c666534bae8b288f470e46c1dcda95b80e15049e0568dc3e","60122b581589cc6a1302db3796854072358eb6ee566eae2d063e2ff5f151f559","56d86b8d84f6f01d64ecce6f73a96fb21be0291dfd9a4c67ba2889b793b29ba6","bca4f4e5fff629d60e01bde4eeb71ba7962b90f2204ec9808881dac33035342b","44db0dfa40bf74f4036f393898130eec5f61a48eb1626bc868b1f3b2311fdb60","6f353c60862b13747e59c7ed838edbdc436c8f17aa8ba04ce0d9e5175ea96bb2","d3c3ae5553f30d2e54a77b54d1c74ca9183b8cf33cb8e3308dee827372e63c27","3c3590217e177f6cce1454c4d7ef27fdea7630f018c5b5ed26ad64a0f656b3db","ee9bb01ffec020b760169c98c6cc9c140de8c5a88a2a830ac537478875766112"]
Anchored: 2026-08-16
Public log entry: search.sigstore.dev, log index 2483496382 · entry 108e9186e8c5677acf0c…
Expected log hash: 9e156a9df8edbfe61e2aac6bdc3033ceb5ecaf971b297c4e0a7645214890c65d The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1786848988221","kind":"published-quote","locale":"de","page":"brand:nexi","quote":"keine zu authorisierende Zahlungen","rating":1,"review_date":"2026-07-12","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=it.icbpi.mobile","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (8b5970f4b146…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.