A witness that is not us.

1 · What a witness does

Once an hour, trusting nothing the site says that it cannot check.

1. It fetches the newest checkpoint and verifies the log's Ed25519 signature against the log key pinned on its own disk, written once at install and never read from the site.
2. It mirrors the whole log and re-reads what it already holds: every line must still be served exactly as it was, and every new line must hold the previous one and recompute. A line that changed, vanished or appeared in the past is a refusal.
3. It checks that the checkpoint extends the last one it cosigned: the same size must have the same root; a larger size must be joined by the log's consistency proof. Two signed checkpoints that nothing joins are a fork: both are kept as evidence, a HALT file stops every later cosignature until a person has looked.
4. It recomputes the root from its own copy. A signed root that is not the root of the lines served is a refusal.
5. Only then it cosigns, with its own key, in the C2SP tlog-cosignature format, and hands the line at the public door, POST /api/register/cosign, where nothing is kept unless a witness listed in code signed it over a checkpoint the log signed.

A cosignature states: this checkpoint is consistent with every checkpoint of this log I cosigned before; I hold a copy of every line up to its size; I recomputed its root from that copy; and no line I held has changed. It states nothing about what the lines say. A witness never reads an item, a file or a name: the log holds fingerprints.

2 · Ten minutes, on a machine of yours

1. A small Linux machine that stays on, with python3 and python3-cryptography. Nothing from pip, nothing that listens, nothing that calls anyone but this site.
2. Download the two files below and compare their fingerprints with the ones printed here.
3. Compare the log key printed below with the vkey field of the checkpoint route. If they differ, stop and write to us.
4. Run the installer with the name you choose for your witness, your domain first: sudo bash install-witness.sh your-domain.org/witness/1. It self-tests, pins the key, makes your key once, and prints your public vkey.
5. Send us the vkey and the name of your organisation, at contact@selione.ai. We list it in code beside the sentence your cosignature states, and the listing appears on the public log. Until then your witness runs dry: it verifies, mirrors and cosigns, and posts nothing.
6. Switch on with echo live > /opt/omnel-witness/mode. From then on, anyone who pins your vkey can refuse a checkpoint you did not cosign, with the open verifier and --witness.
7. Stop whenever you want: remove the cron line, tell us, and we retire your vkey with its date. What you cosigned until then still verifies.

The log key to pin: omnel.selione.ai/log+10dc08d3+AWfF9+0VImjkBj+VDEqbUyVJZh2F6b/3LqXRVeTJ8lhd

3 · What we ask, and what we do not

• Nothing to pay, nothing to sign. You may stop at any time, and we say so publicly beside your name.
• We never see your key, and we never ask for access to your machine.
• Your listing says who you are and what your cosignature states, in your words, reviewed with you. It never says that you endorse Omnel, its organisations or their systems.
• We will not name you as a partner, a client or a supporter anywhere. A witness is a witness.

Witnesses in service today: omnel.selione.ai/witness/2 · omnel.selione.ai/witness/1 (retired 2026-10-11). The specification says how the log is built; the verification page carries the open verifier.