EpochCore / Verifier

Verify any signed response from q-routed.com in your browser.

The page fetches the endpoint, then runs SHA-256, Ed25519, and NIST FIPS 204 ML-DSA-65 verification against public keys pinned into this page, using audited pure-JS cryptography vendored locally—no CDN. No backend. No trust in this page: you can read every byte under view-source.

1.  Pick an endpoint to verify

or paste your own signed response URL

Must be a GET endpoint that returns the x-epoch-dkap-* and x-epoch-classical-sig / x-epoch-pqc-sig headers. Public-key host is auto-derived from the endpoint origin.

How this works

Every response from q-routed.com/q/* ships a co-signature in HTTP headers: an Ed25519 signature (the classical algorithm everyone trusts today) and an ML-DSA-65 signature (the lattice-based algorithm NIST finalized for the post-quantum era). Both sign the same 32-byte commitment — the “seal” — that anchors the response into EpochCore’s D-KaP chain.

This page does the verification entirely in your browser. The crypto comes from @noble/ed25519 and @noble/post-quantum — both audited, dependency-free, pure-JavaScript implementations, vendored locally (served from this origin, never a third-party CDN). Open the dev console: every network request, hash, and signature check is visible.

Why this matters. A skeptic doesn’t have to trust EpochCore that its responses are post-quantum-signed. They run this page, pick any endpoint, and watch the signatures verify against the public keys pinned into this page—not keys handed over by the vendor at request time. The whole audit takes one second. There is no harder claim to falsify.

The same protocol is implemented as a Python CLI for offline audit (epochcore_verifier.py, in the accompanying buyer package). This web verifier and the Python CLI agree byte-for-byte.