Verified issuer keys
To check a signed Typogram you need the issuer's public signing key. These keys are published in several places so any verifier can reach one — including an automated agent whose allowlist is only GitHub or npm, not the open web.
Fetch the registry
One file lists every verified issuer. Each entry's key statement self-verifies, and the same key was confirmed served at the issuer's own domain.
| Source | URL |
|---|---|
| GitHub (raw) | raw.githubusercontent.com/typographics-art/typogram/main/keys/registry.json |
| This site | typographics-art.org/keys/registry.json |
| npm (immutable) | @typographics-art/keys |
| PyPI (immutable) | tgart-keys |
| Per issuer | https://<issuer>/.well-known/tgart-keys.json |
Verified issuers
Loading…
Verify a work
Point tg verify at the registry; it picks the issuer the work names. In the browser, the verify page does the same with no install.
tg verify work.tg.svg --keys keys/registry.jsonAdd your key
Make a key with tg keygen --issuer your-domain, serve it at /.well-known/tgart-keys.json, then submit it (a key-submission issue or a pull request adding keys/your-domain.json). We verify domain control and publish it. Full flow: docs/key-registry.md.