The GSC Keyring

dpuone.ai — the declared trust anchor of the GSC estate (x-gsc-trust-anchor: dpuone.ai on every GSC surface).

Every public signing key GreenCore Solutions Corp. publishes lives on one keyring at one address: https://dpuone.ai/.well-known/jwks.json. Verify GSC once — anything the estate signs verifies from here. Signatures are JWS (RFC 7515) computed over the RFC 8785 canonical form of the signed document.

The kids

kidAlgorithmSignsCustody
gsc-cards-2026-08ES256 (P-256)A2A agent cards across the GSC MCP servers and doors, and the gsc-registry.ai resolver's facts recordsAzure Key Vault — private key non-exported; signing via the Key Vault API only
gsc-radar-2026-08ES256 (P-256)GSC Radar readings — the reading block of radar.json and every entry of the append-only archiveAzure Key Vault — private key non-exported; signing via the Key Vault API only
gsc-amp-2026-08ES256 (P-256)SM-AMP-CPG resolution responses — the signature field of every record returned by /resolve on sm-amp-cpg.org and its 49 jurisdiction nodes (compact detached JWS over the RFC 8785 canonical record)Azure Key Vault — private key non-exported; signing via the Key Vault API only
gsc-x402-receipts-2026-08EdDSA (Ed25519)x402 settlement receipts issued by gsc-marketplace.aiApplication-held (pre-ruling key, listed here unchanged)

How to verify a GSC signature

  1. Fetch the signed document (an agent card, a Radar reading, a resolver record).
  2. Remove its signatures member; canonicalize the rest per RFC 8785 (JCS).
  3. Decode the signature's protected header; read the kid.
  4. Fetch that kid's public key from this keyring.
  5. Verify the JWS signing input BASE64URL(protected) . BASE64URL(canonical payload) against the signature.

A signature that does not verify from this keyring is not a GSC signature.

Rotation and revocation

The keyring is append-only. Keys rotate by minting a successor kid ({scope}-{YYYY-MM}) and publishing both during the overlap window; documents re-sign at their next roll. A retired or revoked kid stays listed with a dated status — it is never deleted. A revoked kid's signatures are not to be trusted from its revocation date.

Attestation

The GSC resolver at gsc-registry.ai names this keyring as authoritative in every facts record it serves — the resolver attests the key; the key signs the cards and the readings.