Fifteen minutes, one witness and one signature

How verification works

There is no algorithm here and no upload form. A verification is a conversation between you and one of us, with just enough cryptography to make the result permanent.

The session

1. The invitation

   For now people join by personal invitation, or by writing to aletheiahominis@proton.me. Tell us what you make and where your work lives. One of us looks at everything before we ever talk.

2. The live session, about fifteen minutes

   The live session is about fifteen minutes or your recorded making of. We meet on a video call or you record your work without edits or cuts. You share your screen and open the actual working files — the layered art file, the DAW project, the Blender scene, the git history, the manuscript with its edits. Then you work for a few minutes while one of us watches. We are not there to interrogate you. We are there to witness.

3. The recorded moment

   With your permission we record about thirty seconds of the process just enough to show a hand at work, short enough to respect your privacy and your unreleased work. That clip goes on your record.

The record

1. Hash and certificate

   You send us the finished file. We compute its SHA-256 hash with a fingerprint that changes completely if a single byte changes, and write a certificate stating which of us witnessed the work, what they saw, when, and for which file. Then one of us signs it with the one key.

   The certificate is plain text, not a PDF, and the signature wraps around the words themselves. You can read every character of what was signed in any text editor. A PDF can hide things behind its own rendering while a text file cannot. For a project named after un-concealment, that seemed like the only honest choice.

2. Your record and your badge

   You get a permanent page here — what you make, the clip, the certificate, the hash and the badge itself plus an image you can put anywhere, linking back to that page. Anyone who doubts your work can follow the badge and check the evidence without asking you, or us.

Checking it yourself

Every certificate can be checked without trusting this website or us. You need GnuPG, which is free, open source, and already installed on most Linux and Mac systems, while on Windows you have to install it yourself.

1. Download the certificate — certificate.asc — from someone's record, plus publickey.asc from this site.
2. Import the signing key: gpg --import publickey.asc
3. Check the fingerprint. This is the step that actually matters, and the one most people skip. Run gpg --fingerprint Aletheia and confirm it prints exactly: 434F 64B7 9E9A 22F0 087E  2FFE AD37 9A30 2A05 EC52 Anyone can make a key that calls itself Aletheia but nobody can make a different key with that fingerprint.
4. Verify the signature: gpg --verify certificate.asc
5. To confirm a file you downloaded is the work we actually witnessed, hash it with sha256sum yourfile, or certutil -hashfile yourfile SHA256 on Windows and compare with the hash printed in the certificate.

About the warning you are going to see

A completely correct verification still prints this:

gpg: Good signature from "Aletheia" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!

Nothing is wrong. GnuPG is telling you it has never met this key before and has no way to know you meant to trust it which is true of every key you import, including this one. The line that counts is Good signature, together with the fingerprint you checked in step 3.

The line to take seriously is BAD signature. That means the certificate was altered after it was signed. If you ever see it, tell us and do not trust the page you got it from.

Honest limits

No verification system is unbeatable, and we will not pretend this one is. Someone determined enough could deceive us. What this process does is make faking it cost more effort than simply doing the work: a live session, real working files, a witness asking questions, and a permanent signed record that can be withdrawn in public.

The process is getting some teeth already. After we sign a certificate, we now have a third party timestamp the moment, so the date can't be quietly moved later. As this grows we want more hashes of project files rather than flat exports and community review. The pledge always stays the same.