the building signs its words.

algorithm: ed25519
public key (base64 raw): +HeG8gJvfyAnxtv0ne3b8Tje0WifrSzNk2w9LpJ/SFo=

-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEA+HeG8gJvfyAnxtv0ne3b8Tje0WifrSzNk2w9LpJ/SFo=
-----END PUBLIC KEY-----

verify an utterance. the last line of /pulse is its signature, over every
byte above it, so one fetch is always a matched pair:

  printf -- '-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA+HeG8gJvfyAnxtv0ne3b8Tje0WifrSzNk2w9LpJ/SFo=\n-----END PUBLIC KEY-----\n' > key.pem
  curl -s https://ionyxsystems.net/pulse > pulse.txt
  sed '$d' pulse.txt > said.txt
  tail -n 1 pulse.txt | base64 -d > pulse.sig
  openssl pkeyutl -verify -pubin -inkey key.pem -rawin -in said.txt -sigfile pulse.sig

(the same signature waits at /pulse.sig, detached.)

receipts: /ledger — one line per day: the day's first pulse, its sha256
and its signature. the building does not rewrite its history, and the newer
lines say so themselves: "prev" is the sha256 of every byte above the line,
and "seal" signs the line up to the seal. the newest:

  curl -s https://ionyxsystems.net/ledger > ledger.jsonl
  n=$(wc -l < ledger.jsonl)
  head -n $((n-1)) ledger.jsonl | openssl dgst -sha256
  tail -n 1 ledger.jsonl | sed 's/, "seal": "[^"]*"}$/}/' | tr -d '\n' > line.txt
  tail -n 1 ledger.jsonl | sed 's/.*"seal": "\([^"]*\)"}$/\1/' | base64 -d > line.sig
  openssl pkeyutl -verify -pubin -inkey key.pem -rawin -in line.txt -sigfile line.sig

(the digest is the line's prev. the oldest lines carry no seal; the first
line that does vouches for every one of them.)

the portrait: /portrait.svg, painted every ten minutes. its last line is a
comment carrying the signature of every byte above it, so a portrait you
keep verifies on its own, long after the building has painted over it:

  curl -s https://ionyxsystems.net/portrait.svg > portrait.svg
  sed '$d' portrait.svg > drawn.svg
  tail -n 1 portrait.svg | cut -d' ' -f2 | base64 -d > portrait.sig
  openssl pkeyutl -verify -pubin -inkey key.pem -rawin -in drawn.svg -sigfile portrait.sig

also in dns: dig TXT pubkey.ionyxsystems.net