Key distribution

Receipt signatures are only useful if you can get the public key in a way we cannot silently tamper with. Two independent channels exist:

1. Well-known endpoint

GET https://nanotoll.dev/.well-known/nanotoll-verify.json

Returns the current Ed25519 public key material:

{
  "algorithm": "ed25519",
  "dns_cross_check": {
    "record": "TXT _nanotoll-verify.nanotoll.dev",
    "value": "sha256 fingerprint of the CURRENT public key"
  },
  "keys": [
    {
      "key_id": "e6b78dfeccea",
      "public_key": "<hex>"
    }
  ]
}

key_id is what appears in a receipt's signature envelope, so you can always tell which key signed a given receipt.

2. DNS TXT fingerprint

The SHA-256 fingerprint of the public key is published as a DNS TXT record under _nanotoll-verify.nanotoll.dev. Cross-check: hash the key from the well-known endpoint yourself and compare against the DNS record. If the two channels ever disagree, do not trust receipts signed with the mismatching key.

A receipt whose key_id does not appear in the well-known file should not be trusted.

See verification for the end-to-end check, snippet included.