Cookies on Headline Recorder

We use necessary cookies to run the site and keep your account secure, and, with your permission, analytics to understand what readers value. How we use cookies

Content integrity

Verify authenticity

Every article and every feed we publish is digitally signed. If even one character is changed after publication, verification fails. Checking happens entirely in your browser; nothing you paste or upload is sent anywhere.

  • ML-DSA-87NIST FIPS 204, security category 5: a post-quantum signature that a future quantum computer cannot forge.
  • Ed448RFC 8032: a classical signature alongside it. Both must be valid, so breaking one algorithm is not enough.
  • SHA-512Fingerprint of the exact published bytes, covered by both signatures with the date and address.

Publisher key check

  • Key list certifiedChecking the offline signature on our key list…
  • Key published in DNSLooking up _pqsig…
  • DNSSECChecking…

Check something

Is this exactly what Headline Recorder published?

By link

Every article links to its signature under “Verify this article”. Feeds: /signed/feed.xml.sig.json, /signed/podcast.xml.sig.json

By file

Publisher keys

Our signing keys

Our key list is signed with an offline key whose ID we publish in DNS (_pqsig TXT record); the check above confirms both automatically. Partners should pin it. Machine-readable: /.well-known/pqsig-keys.json

  • 4d2b d2a8 9f6e 2b6e 7ff1 d2dc c914 ee4b 10e1 9210 3bad 8925 c304 3311 2473 6602 ML-DSA-87+Ed448 · created 2026-10-20
  • b631 30cc f2ed 5398 7bf2 fcb2 e109 75e7 7add d04b 25f4 1762 236d 98d3 06a8 3264 ML-DSA-87+Ed448 · created 2026-10-23

How it works

What a signature proves

  1. When an article is published or edited, our publishing system signs the exact stored article (address, headline, byline, dates and text) at that moment, with a key kept encrypted and separate from the website files.
  2. The signature file holds a SHA-512 fingerprint of those bytes, the time and the key ID, signed by both ML-DSA-87 and Ed448. Both must verify.
  3. This page checks both signatures with our published keys, then compares the signed version with the article as it is on the site right now.
Prefer the command line? pq verify article.sig.json --keys pqsig-keys.json --pin <key-id>