Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“It is all about secure messages and the app is getting it right.”
Google Play · 5/5 · 2025-03-22

Checks (re-run on this request)

✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
✓ Public transparency log — Sigstore Rekor log index 2514967984

Proof data

Record hash (SHA-256): bfe438422825ccba1fc84f7c4488d34e3ee8c7006b35b22f81048aefeb791dda
Signature (Ed25519, base64): WnPsu2IyWTcmbzO9ezGszeJSxc6AEjJBiWUyNQ2cQTp95X7uMB2lw2Hct1mSFsrw7HVdZzEjGgdoTHNPZR3jDQ==
Merkle root: 9ddf6b9053b6e5e7a2f15ee7f3bfc8dfb72c48a1917ae5b7e553033e3ded6523
Merkle path: ["bfe3b61da57f8a0d490951e4fc58b74ee2ba7547f0412857d4f543d7bce47d66","80c80b532d9e5c44a11fd0106632a85c340171fe455a1a741b42aad4225e030b","c713bc8da1d6b986b011b41882a3edc695b886cad56ff7b6e74c8a6180d9020c","476e33c370d130868875e974d5907bbcd2bb12182de7e84f7ba5e010cffb744e","9223d93b765f1477d48a50775fa7a0ed71956f31d7db0ed4163bcf332c3f03b0","420d70454202da2716d346c3c742c4a807ffbb7170fb99ddafa1097cac7d280a","6d426bedb4b81d68b174158732b34852beb767b004738289e2f7ac7ac3076e23","a267ee2a4d4eda95b7be7a73fa31945b3e7a0400364c2842bea242ecf281b5a8","9a6583512a785770c59f8aa4d0cc78015a9e4978e3a8f7ebfec0f0dfd811f29a","f92b20b1317feed6af6b750dcf37c56f59ee499829b902e6c932b94d0b4249f8","92f2286afc3e746fe16e6c11c34e67b45ef943eb1f3da6f931b510e870e97532","5e288a59e4a824b311f53ce11119fa3bb87422117073b42f9bfa2f3833c7c2e7","c2f8e96ad84889353246525497fddb5701494aebed39d9da6e4be168c0346d5b","a7f93f88a87631241c84eb6b5e4f60aee1d6a0fdb7950bae2a7c5cc7f1234330"]
Anchored: 2026-08-19
Public log entry: search.sigstore.dev, log index 2514967984 · entry 108e9186e8c5677a902c…
Expected log hash: be0cb34bbab326d10b25013c37c9294b14554a6c6e9fac3dc68c06dc2c3c60e7 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record: {"dataset_version":"v1787135269737","kind":"published-quote","locale":"en","page":"theme:threema/durability/en","quote":"It is all about secure messages and the app is getting it right.","rating":5,"review_date":"2025-03-22","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=ch.threema.app","v":1}

Verify in the public log

Open the Rekor entry (pre-filled with this proof's log index).
In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (9ddf6b9053b6…), which ties this proof's root to the log entry.
Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.