How to verify a SkyeConnex signed compliance report offline
Verify the dual-signature envelope on any SkyeConnex compliance report or integrity certificate without contacting our platform. Using the public ML-DSA-87 issuer key, any FIPS 204 verifier confirms the signature.
Every signed compliance report and integrity certificate SkyeConnex generates is dual-signed: HMAC-SHA-256 for legacy online verification and ML-DSA-87 (FIPS 204 post-quantum signature) for offline verification. The ML-DSA-87 issuer public key is published at app.skyeconnex.com/security — meaning auditors, regulators, opposing counsel, or your own security team can verify any signed report entirely offline.
This procedure uses Python and the pqcrypto library. Equivalent verification works with Open Quantum Safe's liboqs or AWS-LC.
The procedure
-
STEP 01
Get the report you want to verify
Download the signed JSON export of the report. This is typically delivered as a Sovereignty Audit report, Threat Scenario report, Standards / Compliance report, Resilience report, or per-file Integrity Certificate. The JSON envelope has a top-level 'signature' field (HMAC bytes) and 'pq_signature' field (ML-DSA-87 bytes), plus an embedded 'pq_public_key' (the issuer's verification key, base64 encoded).
-
STEP 02
Pin the issuer public key fingerprint
Visit https://app.skyeconnex.com/security from a known-good browser. The page shows the SHA-256 fingerprint of our ML-DSA-87 issuer public key. Pin this fingerprint locally (write it to your verification host's trust store). For automated verification, your security team should embed the fingerprint in your verification tooling.
-
STEP 03
Compute the fingerprint of the embedded key
From the JSON report, extract the 'pq_public_key' field (base64-encoded). Base64-decode it. Compute SHA-256 over the decoded bytes. The result should match the fingerprint pinned in step 2. If it doesn't, the report's embedded key is not our issuer key — stop. Either the report has been tampered with or you have a man-in-the-middle in the trust chain.
-
STEP 04
Canonicalise the envelope
To produce the bytes that were signed, you must canonicalise the JSON envelope. The signing protocol uses sorted-keys JSON encoding with no leading or trailing whitespace. In Python: json.dumps(envelope, sort_keys=True, separators=(',', ':')) — but exclude the 'signature' and 'pq_signature' fields themselves before computing the canonical form. The result is a byte sequence the signer signed over.
-
STEP 05
Verify with a FIPS 204 verifier
Use the pqcrypto library: from pqcrypto.sign import ml_dsa_87; ml_dsa_87.verify(public_key, message, signature). If the call succeeds without raising, the signature is valid. Equivalent function names in liboqs: OQS_SIG_verify with algorithm 'ML-DSA-87'. In AWS-LC: the LC public key API with 'mldsa87' identifier.
Common questions
What if I can't reach app.skyeconnex.com/security to get the fingerprint?
Pin the fingerprint once from a known-good context (typically the procurement / vendor-onboarding phase). Subsequent verifications use the pinned fingerprint. The platform's continued operation is not required for verification — that's the point.
Does this work for blog post / news article integrity?
The verification procedure is for SkyeConnex's signed compliance reports and integrity certificates. Other artefacts (HTML pages, blog posts) don't carry the signature envelope. For our public content, ordinary HTTPS / TLS provides the integrity guarantees.
Can I write a verification wrapper for my CI / audit pipeline?
Yes — that's a common pattern. Most regulated customers wrap the verification in their CI / audit pipeline. The pq_public_key is embedded in every signed report, so the only host-side configuration is the pinned fingerprint.
What happens if I detect a verification failure?
Contact [email protected] immediately with the failing report. A genuine verification failure indicates either report tampering, a man-in-the-middle, or a possible issuer-key compromise. We treat reports of this nature as P0 incidents.
Want help configuring this?
A 45-minute briefing walks through this configuration on your tenant, live.