{
  "$comment": "CANONICAL. The Solara substrate's kernel signing keys, published as an out-of-band trust anchor. Keyed by RFC 9278 thumbprint URI so rotation is an added entry, never a format change. THE ORIGIN SERVING THIS FILE IS UNTRUSTED BY DESIGN: do not trust it because it arrived over HTTPS from a domain you recognise. Recompute the RFC 7638 JWK thumbprint of each key below and check it equals the map key you looked it up under, and check that map key against a thumbprint you obtained from a DIFFERENT channel (docs, release notes, this repo). The hash is what makes the fetch safe; the transport is not. See docs/trust-anchor.md.",
  "version": 1,
  "keys": {
    "urn:ietf:params:oauth:jwk-thumbprint:sha-256:VwvbN9yIguAset99AdeZyud7ZBHV5CcQa7zZML5ZQds": {
      "kty": "OKP",
      "crv": "Ed25519",
      "x": "INjJhHXQUsJyHMJn1uObwqoskkZjMy8WDWeRAM6xRmc",
      "key_id": "6cd3ef32-1712-4d87-84e0-ff88927c5556",
      "created_at": "2026-06-23T08:16:41Z",
      "status": "current",
      "deployment": "Solara production substrate (synthera-substrate-prod, europe-west1)",
      "$note": "trust_domain is deliberately absent, and the reason CHANGED on 2026-08-07. It is no longer that the substrate cannot emit one: the production substrate was redeployed from synthera e9fce91 that day (revision substrate-00011-tpg) and now emits BOTH trust_domain and kernel_key_thumbprint, which is what made third-party verification against this anchor possible for the first time (synthera docs/evidence/vaid-third-party-verification-2026-08-07/). The reason now is that its trust_domain is 'substrate.internal', reserved by RFC 6761 and chosen so an unconfigured deployment is VISIBLY unconfigured. A conforming verifier SHOULD refuse to bind a trust bundle to a special-use name, so publishing that binding here would invite precisely the binding the name exists to prevent. Key selection works today WITHOUT it: this file is keyed by RFC 9278 thumbprint, and a document names its signing key by thumbprint, which is the lookup the probe performs. A trust_domain binding is added when a real issuer domain is chosen -- an open naming decision, and irreversible once verifiers bind configuration to it."
    }
  }
}