Locked & verifiable.

Paste your manifest YAML. The canonical hash must match 390e78d9121f…. This runs the registry's own canonicalization module (canonical.js) in your browser; for verification that does not trust this registry at all, use any of the four reference implementations offline.

The token countersigns this manifest hash with the timestamp authority's key, so the time claim no longer rests on this registry. Verify with OpenSSL 3 (LibreSSL, the macOS default, cannot check the ESS extension):

curl -sO https://registry.falsify.dev/390e78d9121f8f7a9029d4668d8010df7857c47fef9b06f6b2e6a98d7324590c.tsr
curl -s https://timestamp.sigstore.dev/api/v1/timestamp/certchain -o chain.pem
awk 'split_after==1{n++;split_after=0} /END CERTIFICATE/{split_after=1} {print > ("tsa-" n ".pem")}' n=0 chain.pem
openssl ts -verify -digest 390e78d9121f8f7a9029d4668d8010df7857c47fef9b06f6b2e6a98d7324590c \
  -in 390e78d9121f8f7a9029d4668d8010df7857c47fef9b06f6b2e6a98d7324590c.tsr -CAfile tsa-1.pem -untrusted tsa-0.pem

Expected output: Verification: OK.

• Proves: these manifest bytes hashed to this SHA-256, and the registry attests (Ed25519 signature over hash + timestamp, key at /pubkey) that it saw the hash at the recorded time.
• Timestamp: where an RFC 3161 token is present (the "Independent timestamp" row above), the time claim is countersigned by a public timestamp authority and verifiable offline; backdating it would require compromising that authority, not just this registry. Records without a token rest on the registry's clock alone until anchored. Where a "Transparency log" row is present, the hash is additionally mirrored to the public Sigstore Rekor log with a verifiable inclusion proof.
• Does not prove: the claimed result. A PRML receipt proves the bar was locked before the run — never that the result is good.
• The signature covers hash + timestamp only, not the submitted handle. There is no key-rotation story yet; the current key id is served at /pubkey.
• Limitations: the registry itself is a signed key-value store, not an append-only log — per-record non-equivocation comes from the Rekor entry, and records committed before full-manifest storage (2026-07-11) carry their RFC 3161 token only. No long-term storage guarantee: mirror your hashes in your own infrastructure.