{"object":"passport_keys","status":"signing","keys":[{"kid":"ed25519-e31c2d82da92a114","kty":"OKP","crv":"Ed25519","alg":"EdDSA","use":"sig","x":"HLvxNqISBr_AJlCdpAPCYcvUYH0qRaqte0cyeabuEWs","status":"active","not_before":"2026-10-20T21:30:00Z","not_after":null,"public_key_pem":"-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAHLvxNqISBr/AJlCdpAPCYcvUYH0qRaqte0cyeabuEWs=\n-----END PUBLIC KEY-----\n"}],"signed_message":"UTF-8 bytes of \"AbrahamMoses Decision Passport issuance v2\\n\" + lowercase hex SHA-256 integrity hash + \"\\n\" + kid + \"\\n\" + issued_at. The signature is made once at issuance and carried in the passport ID.","rotation":"Retired keys stay listed with their validity window, so passports issued before a rotation keep verifying. Revoked keys stay listed so that their signatures are recognised as untrusted.","meaning":"The SHA-256 hash shows the passport is unchanged since it was generated; a signature, when present, also shows who issued it (the holder of the published key). They do not show that the content is correct, and they are not a third-party attestation."}