Trust Roots
The Ed25519 verification keys for VMP campaign artifacts, published here so the repository that carries the signatures is never the only witness to the keys.
Why this page exists
VMP (Verified Maximum Performance) is our campaign for provably correct, measured-fastest computation. Its receipts and campaign certificates are signed with Ed25519 keys. A signature alone proves only that the key inside the bundle signed the bundle - which is true of any key an attacker generates. Identity requires the public keys to be pinned somewhere the signed repository cannot rewrite. This page is that somewhere.
The pins
Key ids are sha256(public_key)[:32]. Published 2026-08-15.
- Receipt signing
key id383a419852bd7551cb703a7aef6a3f3a
public key6d53a51428ec1fde9809779ef6a395d9675c8436b0f42e67e87d2aaa54e0b6d9 - Campaign signing
key id95aca466ad0440c19c782d65d52475ec
public key580279a213ee3b70fd56e604f38e0f25859f01dc2ac832340ebff162bedaa93c
How to verify
These pins are published in three independent places that must agree: this page, a GitHub publication, and vmp/TRUSTED_ROOTS.json in the VMP repository itself. A verifier should demand agreement between all three; disagreement means a channel is compromised and nothing should be trusted until it is resolved. Private keys never appear in any repository or on any page - only these public halves.
Key rotation, when it happens, will be recorded in the VMP repository’s rotation chain with each new key signed by its predecessor, and this page will list both during the transition.