{
  "schema_version": "MARGELIS_TRUST_ROOT_v0.2.1",
  "status": "PUBLIC_CANON",
  "issuer": "UAB Rupestelis Holding / Margelis.ai",
  "key_id": "margelis-wtl-ed25519-2026-06",
  "key_role": "dedicated Website Trust Layer signing key; private key held in OpenBao Transit (KMS), never exported",
  "public_key_jwk_url": "https://margelis.ai/.well-known/margelis-wtl-public.jwk.json",
  "verification_method": "margelis-wtl-public.jwk.json",
  "cryptosuite": "eddsa-jcs-2022",
  "proof_purpose": "assertionMethod",
  "public_key_fingerprint": "sha256-hKFDECYKO9JSYLLifCgQ5N5Dy1ozOmLrqKUspOoDsJs",
  "fingerprint_algorithm": "SHA-256 over JCS-canonical public JWK, base64url",
  "published_channels": {
    "dns_txt": "_margelis-trust.margelis.ai",
    "https_well_known": "https://margelis.ai/.well-known/margelis-trust.json"
  },
  "limitations": [
    "The private key is held in OpenBao Transit (KMS); it never leaves Vault. Signing is via Vault transit/sign.",
    "A valid signature proves origin and integrity, NOT the truth of the claim. Truth is carried by evidence, limitations and the human gate.",
    "This is not legal advice, audit opinion, official AI Act certification or regulatory approval.",
    "The proof is Ed25519/JCS. It is not quantum-secure and not post-quantum signed."
  ]
}