Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“You have to send them a ton of stuff”

Checks (re-run on this request)

• ✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
• ✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
• ✓ Public transparency log — Sigstore Rekor log index 3241341297

Proof data

Record hash (SHA-256)

c35f9f36e005c8a7ceff5449ce630ad33cc75e8968b0aaea81d2c6bc7724f618

Signature (Ed25519, base64)

cxfyWOuI79R8A29Gzs4PZt1TaLx2ZZZop14bJqDWNb5YHEVayLLDC6Zc0h703UcHQ6yhJhZhjNEV4R/Vcl09Dg==

Merkle root

4900b1080bdcd3b4c9234f01647614e7004e0a1ae01ead44968e31abeab33265

Merkle path

["c35bb71371cfcf6a6308807dbbab67bff5397e74d56890a6e2499e6147c91bef","d9ec1313165aeadb5d1de862126cd507e0f0242f0d2e9ede7192d0324f9c2f21","3eedfa715772bdf6db5cc2db2ad006b66c25964cbf27f26fbf2e487598b9ff44","6fb8edd974cc3477eb3c63c5192129cb067684391dc64afcebab88c80b07528e","163c0bed2924f1e81fec5826edcc515f243bbd6e77d3fd9190540acc07524776","009b26d8099281ee92706cf788d8a6c57472e800cfd40645ff8c3e2079afdc06","1780c6707dcb3fc97f2d6aa2cd190418ddfc5a451b349f16da508ad35ccdeee9","592bc5af5b0517d21c3db31eb931af5adb6a4ea1bf31ccee13265d5952e7b8d8","e509b111586c7d27eea5fa6449d97b8468947d719d93484a98673d26330f8f49","5b8513024f1647c2b45ad6ba1cd2a40263cda4c9afa4b26db412d2a7d3e4b400","a87b9c875dbab721cc7ce8eb8ac5e76aaa07831ce58af410a9f708afc83f3e49","05e05bda5d4361dbd6c1bceb12d81660ac0315cbc941c5d89d375a08eafe50bc","b4566c8cec38cb371c7e06723f5def3a7cb60681185ba623bcf995dc0e80d9e7"]

Anchored

2026-10-13

Public log entry

search.sigstore.dev, log index 3241341297 · entry 108e9186e8c5677a0e53…

Expected log hash

39342fbb95f8cce5be4111719e5450984494edcdff99b8bd9a5c0d2303b67943 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.

Canonical record

{"dataset_version":"v1791866192176","kind":"published-quote","locale":"en","page":"brand:dashlane","quote":"You have to send them a ton of stuff","rating":1,"review_date":"2026-08-31","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.dashlane","v":1}

Verify in the public log

1. Open the Rekor entry (pre-filled with this proof's log index).
2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (4900b1080bdc…), which ties this proof's root to the log entry.
3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.