{"alg":"ed25519","key_id":"6eb6ca2ac41e690f","public_key":"4ddf1b1c747021da9791678f97f4e87daa472302ede75487ea797c1c54eaa663","verify_recipe":"strip the `signature` field, canonicalize the rest as JSON with sorted keys and separators (',',':') in UTF-8, then verify signature.signature (hex) over those bytes with THIS key — pin this published key; never trust the key embedded in a receipt"}