Verify any QStrike-signed event

The qstrike streaming subdomain publishes the active signing public key at /api/stream/public-key. Save it locally in PEM form.

curl https://stream.qtonicquantum.com/api/stream/public-key > qstrike-pubkey.pem

Save the JSON envelope of any QStrike SSE event you want to verify. The envelope ships with .signature and .payload fields.

# Save the captured SSE event JSON locally
# event.json must contain a .signature field (base64-encoded ECDSA-P256-SHA256)
# and a .payload field (the signed canonical payload string)

Run openssl dgst against the saved public key. Exit code 0 with output "Verified OK" confirms the event was signed by the QStrike streaming key.

echo -n "$(jq -r .payload event.json)" \
  | openssl dgst -sha256 \
      -verify qstrike-pubkey.pem \
      -signature <(jq -r .signature event.json | base64 -d)