Public keys

​

Fetch a key

curl -s https://parmana-sandbox.vercel.app/keys/default

{
  "keyId": "default",
  "algorithm": "ed25519",
  "use": "sig",
  "pem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAQKyaz9ifANjaew96i34spqhM31mBatJ6TTHaMY7mclI=\n-----END PUBLIC KEY-----\n",
  "jwk": {
    "crv": "Ed25519",
    "x": "QKyaz9ifANjaew96i34spqhM31mBatJ6TTHaMY7mclI"
  }
}

const key = await fetch("https://parmana-sandbox.vercel.app/keys/default").then(
  (r) => r.json(),
);

const publicKeys = { [key.keyId]: key.pem };

​

Which keys a record needs

function keyIdsOf(record) {
  const ids = new Set([record.signature.keyId]);
  for (const entry of record.signatures ?? []) ids.add(entry.keyId);
  return [...ids];
}

const publicKeys = {};
for (const keyId of keyIdsOf(record)) {
  const key = await fetch(
    `https://parmana-sandbox.vercel.app/keys/${keyId}`,
  ).then((r) => r.json());
  publicKeys[keyId] = key.pem;
}

​

Keys in production use

• Fetch once, then pin. Store the keys you trust and pass them in from storage. Fetching a key from the same server at verification time only proves the record matches that server’s current key.
• Rotated keys stay valid. Rotation signs new records under a new keyId. The server keeps serving the old key while it holds it, and older records still name the old keyId, so they remain verifiable. Keep every key you have pinned.
• Sandbox and production are separate. Each has its own keys; a record verifies only against the environment that signed it.
• A KeyObject works too. publicKeys values may be node:crypto KeyObjects instead of PEM strings.