Audit log verification key

The Tellus audit log is a hash chain: every event binds to the one before it. At intervals the head of the chain is signed into an anchor, and the anchor is written to storage that cannot be overwritten. Anchors are signed with the private half of the key below, which was created inside — and never leaves — an HSM-like key vault. The public half is published here so you can check those signatures yourself.

What the key shows — and what it does not

With this key you can establish that an anchor was issued by Tellus and has not been altered since.
The key says nothing about the contents of individual events. That is checked separately, by recomputing the hash chain in an integrity export and comparing the chain head against the signed anchor.
This page deliberately sits outside the system it verifies. The key is not fetched from the audit log API — if it were, a compromised installation could serve its own key and make forged anchors look valid.

Published key versions

Version 1Signing now
Created 2026-07-07
Algorithm
ecdsa-p256 (P-256)
Key name
tellus-audit-anchors
Signature prefix
vault:v1:
Fingerprint
d6d7ba320b341af50009210bfffbe8e41131af228776fc482803ebe6f258ddbe
Public key (PEM)
Download
```
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEhHIXsxufSuTaQfUDuD3AweaiQTCp
Dvk/tF8ozxzJK4WkWUYhJqIG5kEjwglw3szrBkAZ7+0HAzH1L/EAWlPTjA==
-----END PUBLIC KEY-----
```

Check the fingerprint

The fingerprint is SHA-256 over the key's DER-encoded SPKI. Recompute it on your own copy and compare it with the value above:

openssl pkey -pubin -in key.pem -outform DER | openssl dgst -sha256

A key rotation adds a new version here; the old ones stay. Every anchor carries the version that signed it (the vault:vN: prefix), so older anchors remain verifiable after a rotation.

How to use the key: the verification guide walks through checking an audit log export step by step.