{
  "object": "craton.receipt.public_key_bundle",
  "version": "v1",
  "protocol": "craton.receipt.protocol.v1",
  "active_kid": "k1",
  "signing_configured": true,
  "created_at": "2026-06-20T19:38:29Z",
  "key_use": "receipt_signature_verification",
  "verification": {
    "sig_alg": "ed25519",
    "signature_field": "receipt.signature",
    "signature_encoding": "base64",
    "message_field": "receipt.payload_b64",
    "message_encoding": "base64",
    "verify_then_read": true
  },
  "keys": [
    {
      "kid": "k1",
      "sig_alg": "ed25519",
      "kty": "OKP",
      "crv": "Ed25519",
      "use": "sig",
      "alg": "EdDSA",
      "public_key_b64": "/oKU6OLcMLjZLYx8YBN+4jSK6HAQ8b+3qnAPKUxHg24=",
      "public_key_encoding": "base64_raw_32_bytes",
      "public_key_jwk": {
        "kty": "OKP",
        "crv": "Ed25519",
        "kid": "k1",
        "use": "sig",
        "alg": "EdDSA",
        "x": "_oKU6OLcMLjZLYx8YBN-4jSK6HAQ8b-3qnAPKUxHg24"
      }
    }
  ],
  "offline_distribution": {
    "pin_with_receipts": true,
    "no_craton_callback_required": true,
    "rotation_rule": "If a receipt kid is unknown, obtain a bundle that contains that historical kid before treating the receipt as verified."
  }
}