Verify evidence

Paste the manifest.json and its signature from a SiteGauge evidence bundle. We recompute the manifest's SHA-256 and check the Ed25519 signature against SiteGauge's public key. That proves the manifest itself is authentic and unaltered. No account needed.

This page checks the manifest only. It does not see the screenshots, HTML or text files in the bundle, so to confirm those are unaltered, compute the SHA-256 of each file and compare it with the hash the manifest lists for it (step 1 of the bundle's README).

A bundle may also contain timestamp.tsr, an RFC-3161 trusted-timestamp token proving when the export existed. Verify it with openssl ts -verify.