# Content Integrity & Transparency

> Every page on this site is hashed and the manifest is Ed25519-signed with a key held off the web host. Anyone can verify it with our published script.

# Content integrity you can verify

At build time we compute a SHA-256 hash of every page's clean-text (Markdown) version, publish the
set at [/transparency.json](https://seoeliteagency.com/transparency.json), and sign the whole manifest with an
Ed25519 key. Anyone, a person or an AI agent, can recompute a page's hash and check the signature
against our [published public key](https://seoeliteagency.com/.well-known/content-provenance.pub).

Page path Verify content hash Enter a path and click verify.

## Verify it yourself

The point of this page is that you do not have to believe it. The verifier is dependency-free
and short enough to read before you run it:

curl -sO https://seoeliteagency.com/verify-content.mjs
node verify-content.mjs /naples-ai-visibility-study/
It checks two separate things: that the manifest is signed by the key we advertise, and that the
page you asked about still hashes to the value inside that signed manifest.

## What this proves

The signing key lives on our build machine. It is not on the web host, not in the site's
repository, and not held by our CDN. So a valid signature tells you something specific and
useful: **whoever produced this manifest held our signing key**. An attacker who
took control of the web host or the CDN, but not the build machine, could not publish content
that verifies.

That is a narrower claim than the one this page used to make. Previously we published hashes
without a signature and said you could confirm the content had not been tampered with. A hash
file served from the same origin as the pages it describes can be rewritten by anyone who can
rewrite the pages, so it detected accidental drift and modification in transit, and not much
else. The signature is what closes that gap, and the old wording claimed more than the old
mechanism delivered.

## What this does not prove

It is **not a witnessed transparency log**. No independent party attests that this
manifest is the one we published, which means we could sign a different version of history and
you would have no way to detect it from here. Closing that requires external witnesses, and we
do not have them. We would rather name the gap than let a passing check imply it is filled.

**Key distribution is the trust anchor.** You fetch our public key from this same
site, so an attacker holding both the host and the signing key defeats the whole scheme. If you
want the stronger property, record the key fingerprint somewhere we do not control and compare
it on a later visit.

Finally, this binds bytes to a key. It says nothing about whether the content is
*correct*. Accuracy is what our sourcing and our published corrections are for; this is
only about whether the page you are reading is the page we signed.