{
  "updated": "2026-07-10",
  "note": "Out-of-band trust root for PriviNet Lumra ProofPacks. A ProofPack is signed by PriviNet only if its signing key and manifest key match a key with role 'record_signing' and status 'active' or 'retired' below, OR carry an in-pack attestation signed by the key with role 'tenant_attestation_root'. Per-tenant signing keys are established by those attestations, not listed here. Production keys are held in a Google Cloud KMS HSM and are non-extractable.",
  "keys": [
    {
      "key_id": "kms-1944107aa98ec035",
      "role": "record_signing",
      "status": "active",
      "active_since": "2026-07-06",
      "custody": "google-cloud-kms-hsm",
      "algorithm": "ecdsa-p256-sha256",
      "signature_encoding": "der",
      "public_key_hex": "04bc55de97e806fbeaf95298588a87cf7f1404640f7b9d359fbbc0f1b2bf408f8be837d1cfa641778a11fd9776be566a2c938b8891d29a7182c15500a05b2e6655"
    },
    {
      "key_id": "kms-6097ab8f15998232",
      "role": "tenant_attestation_root",
      "status": "active",
      "active_since": "2026-07-10",
      "custody": "google-cloud-kms-hsm",
      "algorithm": "ecdsa-p256-sha256",
      "signature_encoding": "der",
      "public_key_hex": "04f371e86f86234164195fca40b7764ea66ab83e09cf029fe0e112a72e20fb9592ac0f75c35affd69a08b3ed498e272909a1445a68937c502b3c7663693452a651",
      "note": "endorses dedicated per-tenant record-signing keys. Each tenant-signed ProofPack embeds a root-signed attestation naming the tenant key; the standalone verifier pins this root and validates the attestation offline. This root never signs records or manifests. Signed message for attestations: sha256 over 'PRIVINET-TENANT-KEY-ATTEST-V1:' + canonical JSON of the attestation body, then the digest hex string's UTF-8 bytes are signed per the standard convention."
    },
    {
      "key_id": "sw-77396abcd4102123",
      "role": "record_signing",
      "status": "fallback",
      "algorithm": "ed25519",
      "public_key_hex": "33b8163a6debfb9fcf6664118c7c7a0a9e9ee9d0429ef97343a57f0727b0edd6",
      "primary_until": "2026-07-06",
      "note": "rotated to HSM for primary signing; retained as availability fallback, honestly labeled per record; not compromised"
    },
    {
      "key_id": "metalert-smartsole-002",
      "role": "demo_device",
      "status": "active",
      "algorithm": "ed25519",
      "public_key_hex": "5cbf574f7a61a92010178d69ada7a33736a23f0f8e279cd360f67c89cf157242"
    },
    {
      "key_id": "voice-platform-demo-001",
      "role": "demo_platform",
      "status": "active",
      "algorithm": "ed25519",
      "public_key_hex": "deb98981a7084aa9500d91cc0139ed529b3da70e738049dd6f1708dd2ca1d6c3",
      "note": "demo voice platform; signs conversation records at the source in /v1/demo/voice-interaction-event-signed (Vendor-signature-preserved)"
    },
    {
      "key_id": "coldchain-reefer-temp-001",
      "role": "demo_device",
      "status": "active",
      "algorithm": "ed25519",
      "public_key_hex": "a68551928de6f33cb7f2341bc4987dadce1da1b1dca74b95ab6034b189a06d37",
      "note": "demo cold-chain reefer temperature logger (vendor ThermoGuard LoRa); one of four independent vendors in /v1/demo/coldchain-sample-incident"
    },
    {
      "key_id": "coldchain-gps-tracker-001",
      "role": "demo_device",
      "status": "active",
      "algorithm": "ed25519",
      "public_key_hex": "5c0da40c72f28f80507c6b185ea35e3ba4e775b65898acd1b7020110f67704de",
      "note": "demo cold-chain GPS asset tracker (vendor TrackPoint LoRaWAN); one of four independent vendors in /v1/demo/coldchain-sample-incident"
    },
    {
      "key_id": "coldchain-door-seal-001",
      "role": "demo_device",
      "status": "active",
      "algorithm": "ed25519",
      "public_key_hex": "cf4ac35a741c1c5ef73bdc1a6a0660c5d0c3ab250b95a75dad333fb1d225ea10",
      "note": "demo cold-chain door and seal sensor (vendor SealSense); one of four independent vendors in /v1/demo/coldchain-sample-incident"
    },
    {
      "key_id": "coldchain-humidity-shock-001",
      "role": "demo_device",
      "status": "active",
      "algorithm": "ed25519",
      "public_key_hex": "71cc1950e192b9c9d52d18c00ccebc8a998e3d71d8808174cb3732902fa54620",
      "note": "demo cold-chain humidity and shock sensor (vendor EnviroTag); one of four independent vendors in /v1/demo/coldchain-sample-incident"
    }
  ]
}