The key, and how to check you got the real one.
Every document SYNTHERA signs names the key that signed it. This page publishes that key in the open, so you, or your own code, can check a signature belongs to us without taking our word for it and without needing an account, a login, or a call to Solara.
Check it in four steps
Pin the thumbprint first
Before you fetch anything, write down the fingerprint below from a channel you trust that is not this page, such as our GitHub documentation or a release note. That copy is your anchor, not the one you are about to download.
Fetch the key
Download the key file below, or read a copy you have already vendored into your own build. Either is fine: the file is not trusted because of where it came from.
Recompute the thumbprint yourself
Hash the key you fetched and check that the result matches both the fingerprint it was filed under in the file and the one you pinned in step one. Don't just read the thumbprint printed next to the key, compute it independently.
Fail closed, then verify
If the fingerprints don't match, stop there. Don't fall back to a cached key and don't proceed with a warning. Only once they match should you use the key to verify the document's signature.
A document's own kernel_key_thumbprint field does not skip step one. It is
written by whoever signed the document, so comparing it to itself proves nothing. The
pinned copy has to come from somewhere the document's author does not control.
The key
Last updated 2026-10-13
urn:ietf:params:oauth:jwk-thumbprint:sha-256:VwvbN9yIguAset99AdeZyud7ZBHV5CcQa7zZML5ZQds INjJhHXQUsJyHMJn1uObwqoskkZjMy8WDWeRAM6xRmc 6cd3ef32-1712-4d87-84e0-ff88927c5556 2026-06-23T08:16:41Z current
Machine-readable copy: /.well-known/synthera-kernel-keys.json, a map
keyed by thumbprint, so adding a new key is never a format change. Look a
key up by the thumbprint you are checking, not by "the current key": a document signed
last year needs the key that was current then.
Why trust a plain file over HTTPS This file can be mirrored, cached, vendored into your own build, or emailed to you, and it is exactly as safe in every case. The hash is what makes it trustworthy, not the connection you fetched it over. See Technical notes below for why.
Today, SYNTHERA documents are verified against this published key using the steps above.
A trust-domain binding will be published when the production issuer domain is set.
Technical notes
References
- RFC 7638, JWK Thumbprint: how the fingerprint above is computed from the key.
- RFC 9278, the thumbprint URI scheme the fingerprint is formatted as.
- RFC 8037, the OKP (Ed25519) key type the public key is published as.
Cross-check channels
The same thumbprint is published in three independent places, two of them on infrastructure we do not run. If they ever disagree, stop: that disagreement is the signal this design exists to produce.
- this page and
/.well-known/synthera-kernel-keys.json, our origin - docs/trust-anchor.md, GitHub
- release notes, GitHub
Why an unauthenticated origin is fine here
Publishing a key would need an authenticated channel, because a substituted key is undetectable on its own. Publishing a commitment to a key, a hash of it, does not need that, because a substituted key fails the hash comparison. HTTPS here stops casual tampering and nothing more; the thumbprint comparison is what catches a fully compromised origin.
Scope
This anchor makes a SYNTHERA-signed document's signature checkable by a third party. We do not claim it is checkable today by the open standard's own verifiers, and we do not claim it isn't; that is tracked separately and this page does not speak to it.
SYNTHERA is the trust layer for multi-agent systems: every agent gets a verifiable identity, scoped authority and a tamper-evident record, so software from different teams, vendors and frameworks can act on each other’s behalf without custom glue between every pair.