Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“customer services of stripe and xero blaming each other”
Google Play · 1/5 · 2026-04-02

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 3124210377

Proof data

Record hash (SHA-256): ab9b16faceeb4381dc2641b7454f8cae4d3f205501e3b2acd1b08fc8b5ddf013
Signature (Ed25519, base64): iou3fwMJBxgB8O/QoPIFcr1PIhJE/kuTf8UPRSlBZaTmZHQ9c/ZHGZuPOEnVB3VmiT0MkRhFWrmh5fmvxC8bDQ==
Merkle root: 3b820b0e91b2475ca02a79fe65f1dcaac35af570ee21f4c868099b9c17e17c1f
Merkle path: ["ab9e3945d2abec9add987929ecc675fe8f31ffb84928b78cb0754e8c9707a0b7","33d632bdbf48fa500fd536f0aa08a4bb18e54827209b9e3f7df233ba52faf4d7","63fda9c280020fadd54d26993783eca4ccb4aee4ba5c841d4bfced818fb8b77a","ea95073be95b677b56ee99df86555daca8039875994815347b7f658368dcbfb9","00f86fac8258b714b2fa7fee596c5a5f221e308d73b1c9f99525bf84798aa423","07394ed00edf46b996c6fb7855497b5f972aac461dce8a47a3b0cda2af88efbc","b958a0017ad86f7453413ba2fd92b6ab5a8f72a8b48cee7aaa1ec83e319782dc","9941c86cc796f3591c5674cf54bff4881000220ff9e941159b19f114567a2ca6","378953e4f0817e6996f56c26ae7895d742b0a5faadb3a0f3e49b2e1a3868df91","9879a780b34ab22f21eadbc340270c5a19f09f40aac1cfcf7c5438995e212531","28ffefb2244b18b2060ebfd51ab22f4a8a1bad9792484efed3f16ec28b14c57f","2bf1b458738469a40c92ac31b9aa588bfb71aec0ab8fce1bd7c62a72390ec53a","83db60ef01b99a503ccd6a6abdd52daa1b692b73cf5b978606f8d217f799000c","00a544d427d2b0ef6286f24c44cfcf3a5f82bad04bf6442e459c003cb18785c1","10553711bf6721bc3fa0f227ed3bf669673b7af202d9c22d19db8987b7ed8714"]
Anchored: 2026-10-07
Public log entry: search.sigstore.dev, log index 3124210377 · entry 108e9186e8c5677a0172…
Expected log hash: 20a5241ced0c7b94303a7b8002f1aae217df3f1371aea54ff5745a148bddda47 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1791349684588","kind":"published-quote","locale":"en","page":"theme:xero/returns/en","quote":"customer services of stripe and xero blaming each other","rating":1,"review_date":"2026-04-02","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.xero.touch","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (3b820b0e91b2…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.