KK-ShieldEnterprise · Sentinel
Docsv5.0.0

ASSURANCE

Signing and verification.

Detached signatures bind canonical report metadata without embedding private keys.

Sign

python scanner.py report sign --report report.kfif.json --private-key signing-private.pem --signature report.sig.json

Verify

python scanner.py report verify-signature --report report.kfif.json --signature report.sig.json --public-key signing-public.pem

Trust

A valid signature can use an untrusted/revoked key. The local registry is not PKI, HSM, or KMS.