Verify a signed card yourself, with no account

2026-09-14 · Council of AI (CSOAI Ltd)

Recompute the content id from the canonical body, then check the Ed25519 signature under the key published in did.json.

Any signed card can be checked with public bytes and no account. Take the ollama:llama3.2:3b care card (signed-care-83d57579098c.json). Step one: take its body object, serialise it as JSON with keys sorted and no whitespace, and hash it with sha256. The result must equal the card's id field, which begins 83d57579098c; the card states this as its preimage_rule, sha256(canonical body). Step two: fetch did.json, find the verification method did:web:csoai.org#board-attestation-1 named in the card's did field, decode its Ed25519 public key, and verify the card's hex signature over the same canonical body bytes. Both checks passed when we ran them on 14 September. One trap: some cards carry whole-number values, such as the ollama:qwen3:4b governance card's accuracy 0 at n=237 (https://councilof.ai/interop/mill-cards-signed/signed-governan-3c96b82c7e64.json); a serialiser that writes 0.0 produces different bytes and a different hash. Each card's verify field points to the loginless verifier at councilof.ai/gspc-verify.

How to verify: fetch the artifacts listed above yourself, and check a signed card against the published key at https://councilof.ai/gspc-verify/.

Measurement, not certification. Not a grade, endorsement or legal finding.