Public audit · 2026-10-30 · Demond Davis, Nisaba LLC · no login

The live receipt signature is Ed25519

Gate audited its own receipt against draft-stone-aivs-01. Both sign a SHA-256 hash with Ed25519 only. Gate publishes the raw public key itself, at /.well-known/prefinality-jwks.json. There is no certificate chain on that key. The live receipt is not quantum-safe.

• Hash: SHA-256. Signature: Ed25519. JWT alg pinned to EdDSA.
• Key: /.well-known/prefinality-jwks.json. Certificate on that key: no.
• Second signature (Ed25519 and ML-DSA-65 over the same receipt-hash bytes): not on the published receipts.

The live receipt is not quantum-safe. The Ed25519 check stays. A receipt with no second signature still verifies. The hybrid and the certificate turn on when the host holds the two keys named in the audit object.

Open the audit object. draft-stone-aivs-01.