Public verification key for GAFAIG signed proof
GAFAIG uses a public verification key to allow external systems to validate signed AI governance certification records. The public key verifies that a GAFAIG proof payload was signed by GAFAIG and has not been altered.
Signed proof makes certification independently verifiable
Each GAFAIG verification response includes a canonical messageString and signature. External systems fetch the public key, verify the signature against the exact messageString, and then evaluate lifecycle and eligibility fields.
Fetch the GAFAIG public key
The public key endpoint exposes the verification key used by external systems to validate GAFAIG signatures.
curl https://www.gafaig.com/api/.well-known/gafaig-public-keyFetch a signed verification payload
The verify endpoint returns the public record, proof object, signature, messageString, and public key URL for a GAFAIG registry record.
curl https://www.gafaig.com/api/verify/GAFAIG-00363095Verify the exact messageString
Independent verification depends on the exact signed payload. Any change to whitespace, ordering, timestamp format, escaping, or field values invalidates the signature.
Verification MUST use:
proof.messageString
proof.signature
proof.verificationKeyUrl
Do not reconstruct the payload from record fields.When a GAFAIG record may be trusted
A downstream system may display a trusted GAFAIG certification claim only when the signature validates and the record satisfies the public trust contract.
If verification fails, do not trust the record
If messageString is missing, the signature is missing, the key is unavailable, or signature validation fails, external systems must treat the record as invalid or unavailable.