Key transparency

Every signed artifact — a receipt or an import contract — names the key that signed it (the kid in its protected header, duplicated as keyId in the envelope). Verifying the signature proves integrity and origin under that key; this page is the other half: the public binding between key ids and the operator behind them, for the one instance we operate.

Machine-readable: keys/mildport-cloud.json — also mirrored in the public spec repository so an independent, versioned copy exists outside our infrastructure. Cross-check both if the stakes warrant it.

Mildport managed cloud

Key id	Status	Since	Key
rk_a9b0c12a41664c32	active	2026-08-09T19:28:22Z	PEM (ES256)
rk_1dc5498e31b8496c	withdrawn — never signed anything	2026-08-09T18:30:56Z	PEM (Ed25519)

2026-08-09 — algorithm unified to ES256. The product’s signature algorithm was unified to ES256 (spec revision) hours after the first key was minted and before it ever signed an artifact — so that key is withdrawn, not superseded: there is no artifact anywhere that verifies against it. The “superseded keys are never removed” rule below protects signed artifacts; a key that signed nothing can be honestly retired. rk_a9b0c12a41664c32 is its ES256 replacement and the key every artifact this instance issues verifies against.

To verify a receipt issued by our cloud: paste the envelope and the issuing key from the table above into the browser verifier, or run the MIT CLI against the downloaded PEM. Both checks run locally — verification and license checks never phone home.

The rules this page follows

• Superseded keys are never removed. A rotation adds a new key with a new kid; every key that ever signed an artifact stays listed, so a receipt verifies against the key that signed it — forever.
• This page covers only the instance we operate. A self-hosted Mildport mints its own signing key on first use, inside its own boundary; its public key comes from whoever operates it, and never appears here. That is the sovereignty design, not a gap: your auditors trust your operator’s key, not ours.
• A key here is a statement by us. The binding you are trusting is “Mildport operates the holder of this key” — published on this domain and mirrored in the tagged, forkable spec repository. If a receipt’s kid claims to be our cloud but does not appear on this page, treat the claim as false.