Check for yourself

Withdrawn verifications

A signature cannot be recalled. If we ever stop standing behind a certificate, the file itself will still verify. This page is where we say so. It is published even when empty, so a missing list can never be mistaken for a clean one.

What a withdrawal means

It means we have changed our minds about our own testimony, and we are saying so where everyone can see. Maybe one of us was shown something that was not what it appeared to be. Maybe we learned later that the work was not theirs. Whatever it is, the reason goes on this page in plain words. No entry is ever silent.

The person's record stays online, marked withdrawn, with the date and the reason. Deleting it would hide the mistake, and the mistake is the part you need to see. The badge on their page will still link here, and here is where the truth is.

What it does not mean: that a verification can be undone. The original certificate will still pass gpg --verify forever, because that is what signatures do. Checking a certificate against this list is the second half of checking it at all.

Check the signed copy yourself

This page is words on a website, and websites can be edited. The list that counts is the signed one, revocations.asc. It is re-signed every time it changes, empty or not, with the same key as every certificate.

1. Download revocations.asc and, if you have not already, the public key.
2. Import the key: gpg --import publickey.asc, and confirm that gpg --fingerprint Aletheia prints 434F 64B7 9E9A 22F0 087E  2FFE AD37 9A30 2A05 EC52
3. Run gpg --verify revocations.asc. You want Good signature from "Aletheia". Then read the file: what is listed there is withdrawn, and what is not listed there is not.

If the signed file and this page ever disagree, the signed file wins, and we would like to hear about it: aletheiahominis@proton.me.