The token

What it is

The unsigned card. One line. Signatures are checked against this file. It is not a signature.

Why it exists

A digital seal is a signature over one exact card. This file is that card, with no signature wrapped around it. When the card changes, this line changes. The old signatures no longer match, and the seal is stale.

How to verify

Do not verify this file by itself. Check the member signature and Dalton's witness against it. Download it as mr.token, then run both commands.

Open this from a sealed card to download the file for that member.

Member

curl -fsS -o mr.token TOKEN_URL
curl -fsS -o mr.token.sig MEMBER_SIG_URL
curl -fsS -o allowed_signers ALLOWED_SIGNERS_URL
ssh-keygen -Y verify -f allowed_signers -I member -n easyeasy-mr@easyeasyspeakeasy.com -s mr.token.sig < mr.token

Dalton

curl -fsS -o mr.token TOKEN_URL
curl -fsS -o witness.sig WITNESS_SIG_URL
curl -fsS -o allowed_signers ALLOWED_SIGNERS_URL
ssh-keygen -Y verify -f allowed_signers -I dalton -n easyeasy-mr-witness@easyeasyspeakeasy.com -s witness.sig < mr.token

The member signature, Dalton's witness, and allowed signers are the other three icons on the card.

All four checks for this card

The other pieces

Generic how-to: How the digital seal works