{"action":"ca-key","ca_key_id":"mn-ca-003","algorithm":"Ed25519 (RFC 8032)","status":"active","active_since":"2026-09-08","fingerprint_sha256_prefix":"f2c8d4a885a70da9","public_key_spki_base64":"MCowBQYDK2VwAyEAUWJgyMWp9oKIGwN9EG8ayz/mYYp1lcQBI58rtpOs8CM=","public_key_raw_hex":"516260c8c5a9f682881b037d106f1acb3fe6618a7595c401239f2bb693acf023","public_key_pem":"-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAUWJgyMWp9oKIGwN9EG8ayz/mYYp1lcQBI58rtpOs8CM=\n-----END PUBLIC KEY-----","canonicalization":"RFC 8785 JCS (JSON Canonicalization Scheme)","rotation_history":[{"key_id":"ca-key-001","status":"retired","note":"Initial key, rotated 2026-08-12 during RFC 8785 migration."},{"key_id":"mn-ca-002","status":"retired-compromised","note":"Private key material was found committed to a public repository. DO NOT verify against this key."},{"key_id":"mn-ca-003","status":"active","note":"Current CA key. Authoritative publication is this endpoint."}],"verification":{"steps":["1. GET the card, e.g. /api/atc/ATC-2026-1509360.json (the served bytes).","2. Parse the JSON and canonicalize ONLY the payload object with RFC 8785 JCS (recursive key sort by UTF-16 code units, ECMAScript number serialization, minimal string escaping, forward slash NOT escaped).","3. sha256(UTF-8 canonical bytes) must equal signature.signed_payload_hash.","4. Ed25519-verify the canonical bytes against this public key and signature.value (64-byte hex)."],"sample":{"card_url":"/api/atc/ATC-2026-1509360.json","canonical_bytes_url":"/api/atc?action=envelope&card_id=ATC-2026-1509360","verify_url":"/api/atc?action=verify&card_id=ATC-2026-1509360"},"node_snippet":"const c = jcs(card.payload); // RFC 8785\ncrypto.verify(null, Buffer.from(c, 'utf8'), caPublicKey, Buffer.from(card.signature.value, 'hex'));"},"registry":"https://github.com/alicelabs-llc/universal-trust-adapter — marketnow/_data/atc/ca-key-registry.json (public keys only)"}