What you can check yourself, and what we still owe you.

tanilo-2026-10-ed25519-7d885da9 — current. Tanilo's signing key, in use since 2026-10-02. Its receipt-signing paths are /evaluate and /v1/verify-facts, both of which run the check themselves; it has no path that signs a verdict supplied by the caller. Those receipts name issuer tanilo.io and this page's key set. It also signs the separately identified key-continuity statement. Its JWKS entry declares role: evaluated, and every receipt it signs carries role: evaluated in the protected header.

ao-composed-2026-06-ed25519-c3abfce3 — retired 2026-10-02, when Tanilo's key went live. It signed /evaluate and /v1/verify-facts receipts on agentoracle.co, both of which run the check themselves; neither signs a verdict supplied by the caller. It stays published so existing signatures under it can still be checked; rotation alone does not invalidate them, and receipt validity, freshness and relying-party acceptance remain separate checks. From 23 June to 28 August 2026 it also signed bytes supplied by the caller through /v1/sign and /v1/sign/batch, and stub verdicts through that host's /v1/compose and /v1/v_gate. Since 28 August the sign routes refuse to sign and the stub routes don't issue. A forged payload could carry any timestamp, so no signature under this key shows on its own that the service issued the payload. It carries no role: it signed both kinds of bytes, so neither role value is true of every signature under it, and under the issuance-path role rule, signatures under it resolve to role unknown. That is separate from signature validity, and a relying party that requires an established issuance path treats unknown as its own fail.

ao-composed-2026-07-ed25519-3d44ba27 — retired; withdrawn 24 September 2026, when its private key was deleted. Its only signing path was the API gateway's /v1/compose (27 July to 24 September), which signed verdicts the caller supplied and whose handler returns 410 since 28 September 2026 (unauthenticated requests are refused with 401 before reaching it). Its signatures prove the bytes are unchanged, not that anything was evaluated. Its JWKS entry declares role: bytes_attested.

ao-receipt-2026-04-ed25519-f2753b7c — legacy. Published 29 April 2026 for the v0.1 receipt format. It signed the attached sample receipt in the spec repo. We found no signing path for it in the current service code. We haven't established where its private key is held or whether it still exists, so we say so here instead of guessing. No role: its full signing history is not established.

ao-fixture-detached-rfc7797-2026-07-ed25519-0f8bf2a5 — test fixture only. Its private key is published in the spec repo (examples/jwks-fixture-detached.json) so the fixture can be reproduced. Anyone can sign with it, so a signature from it proves nothing about issuance. No role.