{
  "kind": "kettleford-certificate-keys",
  "version": 1,
  "note": "Kettleford certificate signing keys: key id → Ed25519 public key (raw, base64url) and its service period. Certificates issued in a key’s period verify; a revoked key’s certificates do not.",
  "keys": [
    {
      "keyId": "kfsig-8e62a5e42221304a",
      "alg": "Ed25519",
      "publicKey": "Tpz9mVLNAbXEJ1FhiUFftcjhBkme7QtW64TZTQsbCr0",
      "label": "demo — not a real certificate authority key",
      "demo": true,
      "validFrom": "2026-10-28T22:04:11Z",
      "validUntil": null,
      "revokedAt": null,
      "reason": null
    }
  ]
}