Become a witness.
Run a small open-source service on your infrastructure that watches the mosskeys transparency logs stay append-only — and cosign each checkpoint as cryptographic proof. Independent witnesses are what turn a signed tree head into one the world can trust.
C2SP tlog-witness · RFC 6962 consistency · Ed25519 & ML-DSA-44 cosignatures
The job of a witness
Three steps, fully auditable
A witness is not a validator and never sees private keys. It answers one question, over and over: "is this log still append-only?"
1 · Receive
Every published Pro-tier checkpoint arrives at your
add-checkpoint
endpoint automatically, with the consistency proof from the last tree size you cosigned.
2 · Verify
You check the log's signatures and the RFC 6962 proof: the new head genuinely extends the old one. If anything was rewritten, the proof fails and you refuse to sign.
3 · Cosign
You return a timestamped cosignature over the tree head. It is merged into the served checkpoint so any verifier can see you attested it.
What you run
Standard software
mosskeys speaks the C2SP tlog-witness protocol — the same one sigsum, omniwitness and armored-witness implement. Every checkpoint is dual-signed, so stock Ed25519 witness software verifies and cosigns it today, unmodified.
- A ~50 MB binary or container on a small VPS, a Raspberry Pi, or spare capacity — pennies a month, near-zero maintenance.
- Two witness keypairs you mint and keep: Ed25519 for ecosystem interop, and optionally ML-DSA-44 to be among the first post-quantum cosigners in the ecosystem.
- Per-log state, atomically: remember the last size you cosigned and never sign two conflicting heads at the same size. That refusal is the entire security property.
Check out the witness operator guide for a walkthrough of the software, keys, hosting, applying, and going live.
POST <your-prefix>/add-checkpoint
old 4214
mFQ0LkJsQz… # consistency proof: 4214 → 4380
mosskeys.com/acme
4380
9U2qSbRQxFMzYp0SNxUZQasTyTj8PoIW9dLsvVc5YHM=
— mosskeys.com/acme Az3grlgt… # hybrid ML-DSA + Ed25519
— mosskeys.com/acme Az3grlMe… # classical Ed25519 (0x01)
→ 200 OK
— witness.example.com/mosskeys Ani4O2RB… # your cosignature (0x04)
— witness.example.com/mosskeys BHZL5s3E… # optionally ML-DSA-44 (0x06)One HTTP call per checkpoint. No accounts, no webhooks, no mosskeys credentials on your side — the proofs carry everything needed to verify.
Transparency is key
Why witnesses matter
Split-view protection
Without witnesses, a compromised or dishonest log could show different histories to different users. Your cosignature says: "the history I see is one continuous chain." Forking the log now means forking past you.
Diversity, not headcount
Anyone can spin up 100 witnesses; that proves nothing. Value comes from operators who are genuinely different: different orgs, jurisdictions, and infrastructure. Which is why a human reviews every application and why the directory publishes who operates each witness.
Consumers decide
Verifiers pin the witness keys they trust and check cosignatures themselves. A listing here is for transparency, it is not our endorsement. More witnesses does not guarantee more security.
Our side of the bargain
mosskeys never signs checkpoints — customers sign their own. The server only relays, verifies, and merges. We never run a witness on your behalf, never count one we operate ourselves, and publish the roster and jurisdictions openly on the directory. Until at least two independent witnesses are live, the directory says the network is still forming.
Why run one
Public good, public name
- Be a named guardian. Your organization is listed publicly with every checkpoint you cosign — the same reputation model as CT monitors and the sigsum witness network.
- Early post-quantum cosigner. The cosignature spec recommends ML-DSA-44 for new deployments; almost nobody serves it yet. You would.
- Protect what you rely on. A witness turns your trust in a transparency log's operator into something you can verify. That's not a favor to the operator. It's a defense of your supply chain.
- The network only works together. Nobody can witness their own log, so operators verify each other's. You protect the logs others depend on; their witnesses protect the ones you depend on. Every witness added makes every log harder to tamper with.
We don't pay for witnessing and don't pretend otherwise: paid witnesses dilute the independence that makes them worth having.
What it takes
Small, boring, reliable
- Binary or container footprint
- ~50 MB
- Small VPS, Pi, or spare box
- 1
- Endpoint with a domain you control
- HTTPS
- Mostly-online works just fine
- Uptime
If your witness is down, submissions retry with backoff and resume from the last size you cosigned — gaps never break consistency.
Co-sign the append-only future.
Tell us who you are and where your witness lives. A human reviews every application within a few business days.
Looking to publish verifiable key histories instead? Go to the quickstart guide.