A two-minute, no-installation demo of Domain Atlas's third-party attestations (SPEC.md §5.11).
Click below and this page issues you a real, signed filing — an ordinary document credential from this domain. Then this same domain's SECOND, independent key — generated once, published separately, and never used to issue anything else here — signs its own opinion about that exact filing, standing in for an independent reviewer or auditor: it never touches, holds, or needs permission from the key that issued it. Everything below is genuine signing and genuine independent verification against two separately-published keys, not a mockup. (The protocol works exactly the same way across two genuinely separate domains — see the footnote below.)
Swap "filing" for a license, a certification, or an insurance policy, and swap "reviewer" for a regulator, an auditor, or a certifying body. Each one signs its own claim, with its own key, checkable by anyone — and can withdraw its own opinion on its own schedule, without needing to touch, hold, or ask permission from whoever issued the thing it's talking about.
Issued by this domain.
Paste a credential's raw JSON below and check it — the filing above, or the attestation
about it. This runs entirely in your own browser: it fetches the SIGNING key's own
published file and this domain's revocation list directly — atlas-key.json
for the filing, atlas-reviewer-key.json for the attestation, two different
keys published at two different paths — then checks the signature and looks the id up in
the revocation list. Nothing here trusts this page; try changing a field above (the
claim, say) before verifying, and watch it fail.
Nothing on this page is stored in a database anywhere. The filing and the attestation are two
separate signatures — from two separate keys, over two separate payloads — revoking one never
touches the other, and neither key was involved in producing the other's signature at all.
The reviewer's identity here is a second key this domain publishes at
.well-known/atlas-reviewer-key.json, generated once, on first use, and never
reused for anything this domain itself issues — genuinely a different key, independently
fetchable and revocable, without needing a second domain deployed anywhere. Nothing stops a
real deployment putting this role on an actual separate domain instead (its own ordinary
.well-known/atlas-key.json, the same shape the Lobby's Neighbor Workshop portal
already relies on for a genuinely separate second domain) — the verification above works
identically either way; this demo just keeps both identities on one running server so it
works standalone, with nothing else to deploy. Back to the plaza.