Commands / kosa8 audit key

kosa8 audit key

Print the public keys that sign the audit log

Every audit entry is signed (ed25519 by default; ecdsa-p256-sha256 for a hardware key) as well as HMAC'd, so anyone with the public key can check an entry without audit.key. This lists every key that has signed this machine's log, oldest first. Give the kid to whoever will verify its records, over a channel other than the records themselves.