Overview

A signing-key ID (kid) is a short identifier of one of Truestamp’s Ed25519 signing keys: SHA-256 over the byte prefix 0x51 followed by the 32-byte public key, truncated to the first 4 bytes and written as 8 lowercase hex characters. It is recorded on every item, block, and entropy observation, bound into each object’s composite hash, and carried in a proof bundle as the s.kid, b.kid, and signed-payload kid fields. A verifier uses it to look up the exact public key that produced a signature, which is what lets signatures made by an earlier key keep verifying after key rotation; under legitimate rotation the proof signer’s kid may differ from the block’s or subject’s kid, and that is allowed. See Ed25519 signatures and the proof bundle wire format; the item-side binding is part of the item’s composite fingerprint.