{
  "keys": [
    {
      "kid": "sar-prod-ed25519-01",
      "kty": "OKP",
      "crv": "Ed25519",
      "x": "n0OM0xBI3wCfJW4_PwUY8zy4yFEArOJQGnqS9CnEfX8",
      "created": "2026-02-14T04:13:26.619025Z"
    },
    {
      "kid": "sar-prod-ed25519-02",
      "kty": "OKP",
      "crv": "Ed25519",
      "x": "2a_BEldn8DHwfU-Gi3QmYbIZ6TB0mBn6HrXTA6BHAgI",
      "created": "2026-03-20T20:00:00Z"
    },
    {
      "kid": "sar-prod-ed25519-03",
      "kty": "OKP",
      "crv": "Ed25519",
      "x": "2a_BEldn8DHwfU-Gi3QmYbIZ6TB0mBn6HrXTA6BHAgI",
      "created": "2026-04-10T18:41:58Z"
    },
    {
      "kid": "defaultverifier-recording-ed25519-1",
      "kty": "OKP",
      "crv": "Ed25519",
      "alg": "Ed25519",
      "public_key_hex": "5675f7c40c934edc66e34d9205be8d82c022378f3cf955d0058ed2f9e5c79720",
      "use": "sar402_recording_attribution",
      "purpose": "Attributes DefaultVerifier recording act only; not delivery, payment, access, release, settlement, or finality.",
      "status": "reserved",
      "not_before": "2026-06-24T22:08:00Z",
      "note": "Reserved for future/non-live use; no active private signer located as of 2026-07-05."
    },
    {
      "kid": "defaultverifier-recording-ed25519-2",
      "kty": "OKP",
      "crv": "Ed25519",
      "alg": "Ed25519",
      "public_key_hex": "e8608e251cce27bfe497da27e97a08d3e1efca4bd4809fb6364fb2af9a34f29e",
      "use": "sar402_recording_attribution",
      "purpose": "Attributes DefaultVerifier recording act only; not delivery, payment, access, release, settlement, or finality.",
      "status": "active",
      "not_before": "2026-07-08T23:01:15Z",
      "note": "Fresh Path B recording key generated 2026-07-08 under Option B sealed/encrypted key-file custody; reserved only pending runtime configuration, signed-wrapper proof, and separate activation approval. Activated 2026-07-11 (status: active). activation_evidence=reports/registry/transitions/defaultverifier-recording-ed25519-2-reserved-to-active-20260711.json;sha256=0572c5d47fbc186e75c40035ea85b4dacdeadff543da9211ab173f0ea6cbba24"
    },
    {
      "kid": "defaultverifier-evaluator-ed25519-1",
      "kty": "OKP",
      "crv": "Ed25519",
      "alg": "Ed25519",
      "public_key_hex": "ad88901c016e2f196ffc6d150227588288f70fe897f54938ef0eeaa567563ee0",
      "use": "continuity_evaluation_receipt_signing",
      "purpose": "Signs ds.continuity_evaluation.v0.1 receipts only; not release, execution, payment, settlement, or finality.",
      "status": "reserved",
      "not_before": "2026-06-27T00:00:00Z",
      "note": "Reserved for future/non-live use; no active private signer located as of 2026-07-05."
    },
    {
      "kid": "sar-prod-ed25519-04",
      "kty": "OKP",
      "crv": "Ed25519",
      "alg": "Ed25519",
      "public_key_hex": "8e15a4fa17aeb91436401e060ba714d6924904bde14c2036641e2793268eb786",
      "use": "sar_settlement_witness_signing",
      "purpose": "Signs settlement-witness SAR receipts only; not delivery, payment, access, release, or finality.",
      "status": "reserved",
      "not_before": "2026-07-09T00:00:00Z",
      "note": "Reserved replacement for sar-prod-ed25519-03 following the 2026-06-27 env-var collision drift and 2026-07-09 exposure incident. Generation/custody (G2) complete per commit 6966374. Not active until proof-of-signing (G8) and separate activation approval (G9) complete. sar-prod-ed25519-03 remains unretired pending separate approval (G12)."
    },
    {
      "kid": "sar-prod-ed25519-05",
      "kty": "OKP",
      "crv": "Ed25519",
      "alg": "Ed25519",
      "public_key_hex": "eef4c4b446c615da04c607e35a94008874512554282072c06385d7bf2d713067",
      "use": "sar_settlement_witness_signing",
      "purpose": "Signs settlement-witness SAR receipts only; not delivery, payment, access, release, or finality.",
      "status": "reserved",
      "not_before": "2026-07-09T00:00:00Z",
      "note": "Loader-compatible (PKCS8 PEM via SAR_ED25519_PRIVATE_KEY_FILE) replacement for the unusable sar-prod-ed25519-04 custody artifact. Generation/custody complete per commit d9f580a with real-loader round-trip verification. Not active until proof-of-signing and separate activation approval. sar-prod-ed25519-04 remains reserved/unusable; sar-prod-ed25519-03 remains unretired pending separate approval.",
      "x": "7vTEtEbGFdoExgfjWpQAiHRRJVQoIHLAY4XXvy1xMGc"
    }
  ]
}