Verify a signed event

The companion verifies every signed response before returning it to the calling client. You can also run that verification standalone — for audit, for bring-up, or to validate output from a third-party signer.

Inputs

• req.json — the v0 signing request the device received.
• resp.json — the signed response the device produced.

Both formats are in nSealr/specs under examples/.

Run

$ nsealr verify --request req.json --response resp.json
✓ event id matches BIP-340 signature
✓ approval_digest matches reviewed material
✓ public key matches signer descriptor

Each check corresponds to a contract:

What it rejects

• Signatures that are mathematically valid but cover a different canonical serialization than the request claimed.
• Responses whose approval_digest does not reproduce the digest of the reviewed material.
• Responses with a public key that does not match the declared signer.
• Disabled-signing firmware returning a “would-have-signed” stub — that path is treated as a deterministic non-signing decision, not a signed event.

Companion-side, automatic

When a signed response flows back through nsealr route (or any other companion surface), the same verification runs before the response reaches the client. A failed verification is fatal — the client never sees the signature.