Verification steps

  1. Load ToneThread Root public key…
  2. Verify Tenant Site Certificate signature…
  3. Verify Post Certificate signature…
  4. Recompute ToneHash of post content…
  5. Compare recomputed hash to certificate…

Revision history

Originally published 2026-05-03, updated 2026-05-18; 10 revisions (this active certificate plus 9 prior).

IssuedSupersededContent hash
2026-05-03T09:12:00.664Z 2026-05-03 09:13:17 tth_v1_0406e93a1de5fd55
2026-05-03T09:13:17.635Z 2026-05-03 09:18:33 tth_v1_0406e93a1de5fd55
2026-05-03T09:18:33.145Z 2026-05-03 09:19:09 tth_v1_0406e93a1de5fd55
2026-05-03T09:19:09.894Z 2026-05-05 01:55:39 tth_v1_0406e93a1de5fd55
2026-05-05T01:55:39.864Z 2026-05-05 02:38:28 tth_v1_47aa32d382757396
2026-05-05T02:38:28.086Z 2026-05-05 02:40:00 tth_v1_47aa32d382757396
2026-05-05T02:40:00.486Z 2026-05-06 14:18:59 tth_v1_47aa32d382757396
2026-05-06T14:18:59.590Z 2026-05-07 16:54:10 tth_v1_90b73f8bc15a0c4b
2026-05-07T16:54:10.410Z 2026-05-18 11:13:20 tth_v1_678dee3de458350b
2026-05-18T11:13:20.109Z — active — tth_v1_223b79bc62bf2eff

What this page exposes

Verification runs on the server. The browser only sees the public summary in the sidebar and the step-by-step ok/fail result above — never the certificate's raw signature, the tenant's raw public key, the ToneHash salt, the per-axis tonal scores, or the compact fingerprint string. Those stay on the signing host.

The public JSON at /tonehash/cert/the-gift-and-the-jeans mirrors the same surface. To independently audit a certificate's raw signed payload you must request an authenticated cert-bundle export from the operator — how to request access.