Knox Root · ed25519
Public Key.
The cryptographic root of every attestation in The Keep. Use it to verify any artifact yourself — trust nothing on faith.
Knox Root · ed25519
The cryptographic root of every attestation in The Keep. Use it to verify any artifact yourself — trust nothing on faith.
Copy this verbatim, or fetch it directly:
-----BEGIN PUBLIC KEY----- MCowBQYDK2VwAyEAsIFlA2fc+b8pk8juSROiEGmgCgLlCiwSydSFErrSj7g= -----END PUBLIC KEY-----
Raw URL: https://keep.axetechnologies.ca/keys/archive_signing.pub
# 1 · Pick an artifact slug from /manifest.json
SLUG=captain-roadmap-18mo
# 2 · Fetch the pristine source + the public key + the manifest entry
curl -sO https://keep.axetechnologies.ca/r/$SLUG/artifact.html
curl -sO https://keep.axetechnologies.ca/keys/archive_signing.pub
ENTRY=$(curl -s https://keep.axetechnologies.ca/manifest.json | jq ".artifacts[] | select(.slug==\"$SLUG\")")
# 3 · Verify
python3 - <<PY
import hashlib, json, sys
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
from cryptography.hazmat.primitives import serialization
entry = json.loads('''$ENTRY''')
sha = hashlib.sha256(open('artifact.html','rb').read()).hexdigest()
assert sha == entry['knox']['sha256'], 'sha256 mismatch'
pub = serialization.load_pem_public_key(open('archive_signing.pub','rb').read())
msg = f"{sha}|{entry['knox']['signed_at']}|keep.axetechnologies.ca".encode()
pub.verify(bytes.fromhex(entry['knox']['ed25519_sig']), msg)
print(f'VALID · signed at {entry["knox"]["signed_at"]}')
PY
IBM watsonx.governance sells "AI Factsheets" as a compliance product. They are paper. The Keep's lineage is cryptography. The difference is whether you have to take someone's word for it.
If The Keep's server is compromised tomorrow and an attacker substitutes a forged roadmap, the substitution will fail signature verification against this key. The chain only stays valid if every link is signed by the holder of the private key — which lives offline. That's the moat.