Status, on the record
Operational checked 2026-08-12 · live answer at /v1/status
This page is the human-readable sibling of the machine-readable status endpoint. It also carries two things a status page usually dodges: exactly who holds the signing key today, and what a Redeal outage does and does not mean.
Who holds the signing key
- scheme
- ECDSA P-256 (es256) — every new certificate signature verifies against the published public key. Certificates issued before 2026-08-12 carry Ed25519 signatures and still verify against the retired key below.
- public key
- es256:037ecf680d2b5dc2589b38dfb3b5a0ebc834eb4cbe26c88e48efc0d0be82ed97cb
served live at GET /v1/status; pin it yourself if you verify at scale - custody today
- AWS KMS (Stockholm region), used sign-via-API: the server can request signatures but can never hold or export the key, and every signing call is logged by AWS. There are no open custody caveats.
- retired key
- ed25519:3b128ffa6847e25a54063f0d74152a09dfc35c0651df076d36cb54cb7f8376f5
the pre-KMS deployment-held dev key, retired 2026-08-12. It stays on the published legacy list forever, so every certificate it signed keeps verifying. Verification accepts the current key or any legacy key.
Incidents and key rotations
| date | event |
|---|---|
| 2026-08-11 | First public deployment. No incidents. No key rotations. |
| 2026-08-12 | Key rotation — custody upgrade. Signing moved from the deployment-held Ed25519 dev key to an AWS KMS ECDSA P-256 key (sign-via-API; the server can never hold or export it). New certificates carry es256: signatures; the retired key stays published on the legacy list, so all pre-rotation certificates keep verifying. Acceptance test re-run green: pre-rotation cert c_13458d82193a3bec still valid:true, new certs verify offline against the new public key. Procedure: docs/ops/key-rotation.md in the repo. |
Empty is the goal. Any incident or rotation gets a dated row here, never a quiet fix.
What an outage would mean
Very little, for certificates that already exist. A Redeal certificate carries its signature and its Merkle inclusion proof; both verify offline against the public key above and any tree head you already hold. If redeal.dev disappears tomorrow, every issued certificate still checks out.
What stops during an outage is new work: no new deals, no new tree heads, no /v1/verify lookups by ID. Trust in Redeal was designed never to depend on Redeal being up.