Verify a bundle, in your browser.

Drop a signed SwitchTender audit bundle below. It is checked here, on your machine, by the same Go verifier the format specifies, compiled to WebAssembly. Nothing is uploaded. The file never leaves your computer, and the verdict is reached from the file alone, with no trust in any server, including this one.

Running loomseal v1.5.1, built from that release tag. Check the same bundle with loomseal verify at the same version and it must reach the same verdict.

Leave it blank and this page still checks every link and the signature, and it cannot tell you whose install produced the file. The fingerprint is what turns "this was signed" into "this was signed by them". Every install publishes its own at /.well-known/loomseal.json on its own domain.

A bundle carries the audit chain, the install's public key, and any timestamp anchors. This page checks the producer signature and the hash chain in full and reports what each anchor proves. Get a bundle from the audit page of any SwitchTender install, or run switchtender audit bundle. Evidence artifacts stay on your disk, so their digests are reported as referenced rather than opened. The boundary a verdict draws is set out in the concepts.

The bundle names the key that signed it, but a name is not trust. Anchor that key one of two ways: fetch it from the producing install's own domain at /.well-known/loomseal.json, so HTTPS and the domain vouch for it; paste a fingerprint you were handed out of band into the box above, and the verdict holds the bundle to that exact key.