{
  "kind": "lumi_signing_keys",
  "keys": [
    {
      "key_id": "lsk_5c8c2f54fd228547",
      "key_type": "lumi-ed25519",
      "alg": "ed25519",
      "public_key": "7d8806265f0ce62af2bf354392246019e5f607ae2470c611bffedba59ef82e52",
      "use": [
        "lumi_check",
        "trust_check",
        "tested_badge"
      ],
      "pinned": true,
      "status": "active",
      "signing": true
    }
  ],
  "status": "active",
  "pinning": "lumi-scanner-kit and lumi-trades-mcp ship these public keys (rotation list: active, next, retired) and reject any other key with lumi_untrusted_key. They never fetch this document to decide trust.",
  "verify": {
    "steps": [
      "receipt_hash = sha256 hex of the canonical JSON (sorted keys, no whitespace) of the object without receipt_hash and signer.",
      "signer.message must equal `lumi-signed:<kind>:<receipt_hash>`.",
      "ed25519 verify(base64 signer.signature, utf8 signer.message, hex signer.public_key); the public key must be a pinned, non-retired Lumi key.",
      "Reject when expires_at is in the past (badges and checks are short-lived on purpose)."
    ],
    "helper": "lumi-check (npm): verifyLumiSigned(response, { publicKeys }) with the pinned keys listed here (Apache-2.0).",
    "endpoint": "https://api.lumitrades.io/v1/check/keys"
  },
  "note": "A dedicated signing key, not a wallet: it cannot move funds. Lumi's test-buy receipts stay signed by the paying wallet (RECEIPT_FORMAT)."
}