Trust Registry

Overview

The source implementation provides a public lookup by exact certificate ID. It returns the signed scoped claim and recalculates current status without returning private evidence. The route has no entries until the certificate path is deployed and an operator-approved assessor decision issues a certificate. Technical issuance alone does not establish independent certification.

• Check the canonical API origin and exact certificate ID.
• Verify the signature against an issuer key you already trust; an embedded key alone is not a trust anchor.
• Treat EXPIRED, REVOKED, SUSPENDED, and unavailable as not current.
• Do not treat an absent entry as evidence of safety or unsafety.

Production checklist

• Keep credentials in a server-side secret store.
• Set explicit cost, latency, privacy, provider, and regional constraints.
• Capture route and evaluation evidence for incident review.
• Test timeouts, cancellation, fallback, and denied-policy paths before rollout.