{"schema_version":"0.10","protocol":"VCAP Content Verification Protocol","protocol_uri":"https://wellspr.ing/protocols/vcap","genesis_key_id":"wellspring-2026-signing-key-01","genesis_committed_at":"2026-04-24T00:00:00Z","transparency_log":"https://wellspr.ing/api/vcap/content-transparency","failure_report":"https://wellspr.ing/api/vcap/verification-failure","last_updated":"2026-05-03T00:00:00Z","rotation_policy":"Keys rotate with ≥30-day overlap windows. Each new key is signed by its predecessor. Revoked keys appear with status:'revoked', revoked_at, and revocation_reason. Walk chain from genesis kid to find the current active key.","nonce_requirements":"Nonces MUST be generated from a CSPRNG (OS /dev/urandom or equivalent). Minimum 16 bytes (32 hex chars). Predictable PRNGs are a known attack vector.","timestamp_tolerance_ms":90000,"keys":[{"kid":"wellspring-2026-signing-key-01","algorithm":"Ed25519","kty":"OKP","crv":"Ed25519","x":"-ke_dg_JYedaZ478zRPZUjohg3kK6n2HO55UxbbK3vo","fingerprint":"533ee07900803f76","status":"active","valid_from":"2026-04-24T00:00:00Z","valid_until":null,"signed_by":"genesis","rotation_sig":null,"custody":"operator-held","ptp_level":1,"note":"Genesis key. Operator-held. Level 1 PTP. TEE-held keys required for Level 3 non-repudiation."}]}