{
  "key_id": "ed25519-1f89c22423ab21b2",
  "algorithm": "ed25519",
  "public_key_spki_pem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAinrBjEYL87NkYKI+WQWRg0flzXYTbUImW5xwnmkZUdQ=\n-----END PUBLIC KEY-----\n",
  "purpose": "Verifies manifest.json integrity.signature — an Ed25519 signature over the RFC 8785 (JCS) canonical form of manifest.json with integrity.signature removed. This is the published trust anchor; the corresponding private key is held offline by Apeiris and never enters the repo.",
  "created": "2026-07-06",
  "rotation": "To rotate: generate a new keypair, publish the new public key here (bump key_id), re-sign the manifest, and retain the prior key_id for verifying historical releases."
}