Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“a month later I received an invoice in my e-mail inbox about a « widget » I never selected”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
f7b06899b19843b5d459fcba9f02455b1fb53d75f6530723eb695657669cf8df
Signature (Ed25519, base64)
mbWXbZId4dp/ei7hhAXxi9dqTIXSDxLYLFvkLffZeHACEx75lFQ6doPA7q5yP7WwcuTJilheM1DGt33HQZXiAQ==
Merkle root
2cd516e344e4be63e12361494ae610d89d15708131c24034ae0c7b134b8bcc53
Merkle path
["f7b24237e529ba59bf8533c58e09f2e27a96ea7b6638659ab5c30c94e8818122","8cb313bcefa6b0ac425b4cbe2aca71189f7584a985edd719fa9e726ac1516f69","eaebefdc64d1bd4db84177f53dc6f0feaa5f093d33a47b289d84a4ac7218f762","157aa7acc6d8062acab3e2b68c92333bc80a463bfd46dc5280da616ff9a1f9f0","d4ee94803e0a08a458813683d8f812999fc9dd46b4ea60b3dc2c078d0bb27004","c2c071fa11089b4198d1df1115a464e08b431043da0326f7329bf928ca38e42a","f9a1dafca6c9959b073fc57618ce6c76e985f5379bf0fb7aab4ffe99add2c568","790134d86216f2b43cb7c62d62bc01f321be89c0c2643c81e8011f58ef010cf4","955ee5f3bef1f77d7b587a284caf5e55d6e9cca94865c7f5caac8588080f92c4","539692550100ea34bd77d19dcb830666e22d695716a529f2ff120f8cb24b10f7","d40454fcdfece446f054f41548f1fd448aac182fa964cd5aa1572cf3ce540038","aa7b693b0830ee9eae981984585361b8753718ad8d2bd84330c9c33fd42f9d70","cda30523fec3f0d7bb757043316994e9f10c4260ab2c72c5da653846620fb3ea"]
Anchored
2026-08-19
Public log entry
search.sigstore.dev, log index 2514341362 · entry 108e9186e8c5677a67a1…
Expected log hash
81a850cd5c32c6b6ee86a2774571659cf829f205adaa17a6b9e9a6f5bef7642d The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1787126744998","kind":"published-quote","locale":"de","page":"brand:klara","quote":"a month later I received an invoice in my e-mail inbox about a « widget » I never selected","rating":1,"review_date":"2026-05-11","source":"Trustpilot","source_url":"https://www.trustpilot.com/reviews/6a019bdcec5b7359cda01b07","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (2cd516e344e4…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.