{
  "zone": "t.probe.isitdns.net",
  "context": "isitdns/opshal/attest",
  "wire": {
    "version": 2,
    "encoding": "base64url",
    "length_bytes": 112,
    "layout": "payload(48) || ed25519_signature(64)",
    "payload_layout": "ver(1)|kid(4)|ts(4)|qhash(16)|transport(1)|flags(2)|ecs(4)|egress(16)",
    "signed_over": "CONTEXT || 0x00 || payload",
    "dnstap_extra_magic": "shal"
  },
  "keys": [
    {
      "kid": "pns1",
      "pubkey": "7f52f24997a9365879f7915347442dba36317a74855b3268c8efce78b9afe977",
      "algorithm": "ed25519",
      "purpose": "attest",
      "sink": "pns1.isitdns.net",
      "location": "New York"
    },
    {
      "kid": "pns2",
      "pubkey": "760096025815bfaece769dd2d53b39ed7c05340e853aadf83fa4087f7f7a6733",
      "algorithm": "ed25519",
      "purpose": "attest",
      "sink": "pns2.isitdns.net",
      "location": "Phoenix"
    },
    {
      "kid": "pns3",
      "pubkey": "28111cd033b014dee4183a9fe25420a08995fa9ec01d928fee832ecc1ee683a9",
      "algorithm": "ed25519",
      "purpose": "attest",
      "sink": "pns3.isitdns.net",
      "location": "Frankfurt"
    }
  ],
  "signature": "BB/o+kkropAhyVLBV8hse/YrlrVzCWizDlYiyc2o1iXhGUsPm9sl5Qej0A8cyqBzekV8VjHhfoRrLi3rcFtKCg==",
  "payload_b64": "eyJjb250ZXh0IjoiaXNpdGRucy9vcHNoYWwva2V5cyIsImtleXMiOlt7ImFsZ29yaXRobSI6ImVkMjU1MTkiLCJraWQiOiJwbnMxIiwicHVia2V5IjoiN2Y1MmYyNDk5N2E5MzY1ODc5Zjc5MTUzNDc0NDJkYmEzNjMxN2E3NDg1NWIzMjY4YzhlZmNlNzhiOWFmZTk3NyIsInB1cnBvc2UiOiJhdHRlc3QiLCJzaW5rIjoicG5zMS5pc2l0ZG5zLm5ldCJ9LHsiYWxnb3JpdGhtIjoiZWQyNTUxOSIsImtpZCI6InBuczIiLCJwdWJrZXkiOiI3NjAwOTYwMjU4MTViZmFlY2U3NjlkZDJkNTNiMzllZDdjMDUzNDBlODUzYWFkZjgzZmE0MDg3ZjdmN2E2NzMzIiwicHVycG9zZSI6ImF0dGVzdCIsInNpbmsiOiJwbnMyLmlzaXRkbnMubmV0In0seyJhbGdvcml0aG0iOiJlZDI1NTE5Iiwia2lkIjoicG5zMyIsInB1YmtleSI6IjI4MTExY2QwMzNiMDE0ZGVlNDE4M2E5ZmUyNTQyMGEwODk5NWZhOWVjMDFkOTI4ZmVlODMyZWNjMWVlNjgzYTkiLCJwdXJwb3NlIjoiYXR0ZXN0Iiwic2luayI6InBuczMuaXNpdGRucy5uZXQifV0sIm5vdF9hZnRlciI6IjIwMjYtMDgtMDJUMTY6MTA6NThaIiwibm90X2JlZm9yZSI6IjIwMjYtMDctMjZUMTY6MTA6NThaIiwicmV2b2tlZF9raWRzIjpbXSwidiI6MX0=",
  "intermediate_cert": {
    "payload_b64": "eyJjb250ZXh0IjoiaXNpdGRucy9vcHNoYWwva2V5cyIsImludGVybWVkaWF0ZSI6IjFjNjI0MGY3N2Y2NjE0OWEzMmQyOGMwNmVjNzhlMTQ2MzdkYzIxOGZhMWMzMjE0ZmFmZTU2ZTk1YWY4Y2EzY2EiLCJub3RfYWZ0ZXIiOiIyMDI3LTA3LTI2VDEyOjQwOjM1WiIsIm5vdF9iZWZvcmUiOiIyMDI2LTA3LTI2VDEyOjQwOjM1WiIsInJvb3QiOiJjZTE0ZTBlNjIyZGUzNjhiMDYwNTljMGY5OTAwY2VhZTg4MWI1OWVmNjYxNjkxYTc4MDc5YmQwODkxOWQ5YmYyIiwidiI6MX0=",
    "sig": "hwXQFnPKukkuOZg2h6iDQSPejrlVBJKl0rdnUBIZcL8rNOcKl1Rcxoyh3dJyflHV24qHX3LSe/h/t4mud7DfBA==",
    "payload": {
      "context": "isitdns/opshal/keys",
      "intermediate": "1c6240f77f66149a32d28c06ec78e14637dc218fa1c3214fafe56e95af8ca3ca",
      "not_after": "2027-07-26T12:40:35Z",
      "not_before": "2026-07-26T12:40:35Z",
      "root": "ce14e0e622de368b06059c0f9900ceae881b59ef661691a78079bd08919d9bf2",
      "v": 1
    }
  },
  "trust_tier": "signed",
  "trust_note": "payload_b64 is the authoritative signed byte string: verify it as CONTEXT||0x00||payload against the intermediate, then check the intermediate against the root whose fingerprint is published as a DNSSEC-signed TXT at _anchor.probe.isitdns.net. Authenticate that with `delv +root`, which goes through the IANA root key rather than any CA. Never re-serialise the JSON to check the signature; use the bytes as sent.",
  "anchor": "_anchor.probe.isitdns.net",
  "revocation": "revoked_kids is carried inside the signed payload (empty today)",
  "docs": "https://isitdns.net/protocol"
}