{
  "issued_utc": "2026-02-12T04:00:00Z",
  "keyring_version": "v1.0.1",
  "keys": [
    {
      "crv": "Ed25519",
      "kid": "mvg.airgap.kit.release.signer.2026-02-12.v1.demo.c2842e0e2b",
      "kty": "OKP",
      "not_after_utc": "2027-02-12T00:00:00Z",
      "not_before_utc": "2026-02-01T00:00:00Z",
      "note": "Active signing key for air-gapped verifier kit release DSSE receipts.",
      "roles": [
        "airgap_kit.release.dsse.sign"
      ],
      "status": "active",
      "x_b64u": "x9s96hfSX3m13F6MGhQzESKBeA6m5W19DcTKUpzV04M"
    },
    {
      "crv": "Ed25519",
      "kid": "mvg.airgap.kit.commitments.signer.2026-02-12.v1.demo.f8e6acc97f",
      "kty": "OKP",
      "not_after_utc": "2027-02-12T00:00:00Z",
      "not_before_utc": "2026-02-01T00:00:00Z",
      "note": "Active signing key for commitment log heads and private release receipts.",
      "roles": [
        "airgap_kit.commitments.dsse.sign"
      ],
      "status": "active",
      "x_b64u": "iFPHVCoJYxSmCu-ce8UDiwKLgOu-3rhGjxUqucix7VQ"
    },
    {
      "crv": "Ed25519",
      "kid": "mvg.airgap.kit.headchain.signer.2026-02-12.v1.demo.46caf40306",
      "kty": "OKP",
      "not_after_utc": "2027-02-12T00:00:00Z",
      "not_before_utc": "2026-02-01T00:00:00Z",
      "note": "Active signing key for commitment headchain heads (log-of-heads).",
      "roles": [
        "airgap_kit.headchain.dsse.sign"
      ],
      "status": "active",
      "x_b64u": "NAxUTn-PROYuvRO8L74DC_GTO8S5w6E1Auqii1vOPqw"
    },
    {
      "crv": "Ed25519",
      "deprecated_after_utc": "2026-02-01T00:00:00Z",
      "grace_until_utc": "2026-06-01T00:00:00Z",
      "kid": "mvg.airgap.kit.release.signer.2025-11-01.v0.demo.01f3447020",
      "kty": "OKP",
      "note": "Deprecated demo key (example). Kept only to demonstrate grace-window behavior.",
      "roles": [
        "airgap_kit.release.dsse.sign"
      ],
      "status": "deprecated",
      "x_b64u": "uvKYnJUgT9fR71emrHiTVCH3V5cGXfZ6zbKt5k7JNyg"
    },
    {
      "crv": "Ed25519",
      "deprecated_after_utc": "2026-02-01T00:00:00Z",
      "grace_until_utc": "2026-06-01T00:00:00Z",
      "kid": "mvg.airgap.kit.commitments.signer.2025-11-01.v0.demo.8123bd5b7b",
      "kty": "OKP",
      "note": "Deprecated demo key (example).",
      "roles": [
        "airgap_kit.commitments.dsse.sign"
      ],
      "status": "deprecated",
      "x_b64u": "QYVmTXbhl5NBkPbYHAxb2S5POk6W5hn8Fs2yCcwQ1sU"
    },
    {
      "crv": "Ed25519",
      "deprecated_after_utc": "2026-02-01T00:00:00Z",
      "grace_until_utc": "2026-06-01T00:00:00Z",
      "kid": "mvg.airgap.kit.headchain.signer.2025-11-01.v0.demo.94b0dd9c43",
      "kty": "OKP",
      "note": "Deprecated demo key (example).",
      "roles": [
        "airgap_kit.headchain.dsse.sign"
      ],
      "status": "deprecated",
      "x_b64u": "74e_HOn9-vOAeD5AG-ktxGtenNQRE7BtPyhQRwecyCI"
    },
    {
      "crv": "Ed25519",
      "kid": "mvg.airgap.kit.release.signer.2026-02-12.v2.demo.00fd04c0dc",
      "kty": "OKP",
      "not_after_utc": "2027-02-12T00:00:00Z",
      "not_before_utc": "2026-02-12T00:00:00Z",
      "note": "Active signing key (v2) for air-gapped verifier kit release DSSE receipts.",
      "roles": [
        "airgap_kit.release.dsse.sign"
      ],
      "status": "active",
      "x_b64u": "qENvnow07lwfozfElFm23gwS5jVazbh_keQ7pehj6Ww"
    },
    {
      "crv": "Ed25519",
      "kid": "mvg.airgap.kit.commitments.signer.2026-02-12.v2.demo.a14f297757",
      "kty": "OKP",
      "not_after_utc": "2027-02-12T00:00:00Z",
      "not_before_utc": "2026-02-12T00:00:00Z",
      "note": "Active signing key (v2) for commitment log heads and private release receipts (blinded commitments).",
      "roles": [
        "airgap_kit.commitments.dsse.sign"
      ],
      "status": "active",
      "x_b64u": "noOsxdx68QIH7PthznX4oQhOHBhLFwqTpba7Hn8S6ak"
    },
    {
      "crv": "Ed25519",
      "kid": "mvg.airgap.kit.headchain.signer.2026-02-12.v2.demo.6341119c8f",
      "kty": "OKP",
      "not_after_utc": "2027-02-12T00:00:00Z",
      "not_before_utc": "2026-02-12T00:00:00Z",
      "note": "Active signing key (v2) for commitment headchain heads (log-of-heads).",
      "roles": [
        "airgap_kit.headchain.dsse.sign"
      ],
      "status": "active",
      "x_b64u": "E4_mO9t8VGELzD4yiPgdZx3-iOzqOcfFkEYyrwC-PLw"
    }
  ],
  "policy": {
    "deprecated_key_grace_days": 120,
    "fail_closed": true,
    "notes": [
      "This keyring is a signed snapshot. New keyrings are issued for rotations.",
      "Verifiers SHOULD accept deprecated keys within grace windows to validate historical artifacts.",
      "After grace, verifiers should HOLD unless an explicit legacy override is enabled."
    ],
    "post_grace_behavior": "HOLD",
    "revoked_behavior": "FAIL",
    "time_source": "local_system_clock"
  },
  "root_note": "Signed keyring snapshot. Root trust anchors may rotate; verifiers should accept any active root anchor in the published trust anchors set.",
  "schema_id": "mvg.airgapped_verifier_kit.keyring@1"
}