signproof

Overview ¶

signproof is the demo-side identity-proof tool: it mints keypairs and signs identity verify-control proofs (compact JWS over the RA-served signingInput).

This is what a registrant's own tooling does in production — the private key never touches the RA. Run via `go run`:

go run ./scripts/demo/signproof keygen -alg ed25519 -out key.pem
    → writes the key, prints the did:key identifier on stdout

go run ./scripts/demo/signproof sign -key key.pem -kid KID -input SIGNING_INPUT
    → prints the compact JWS on stdout (alg auto-selected from
      the key type: Ed25519 → EdDSA, P-256 → ES256)

The JWS protected header carries kid + the embedded public jwk. The jwk header is what lets the RA's noop resolver synthesize a DID document for local development; the hardened web resolver ignores it and uses the fetched did.json.