HOLINA · Post-quantum call provenance

Verify a sealed call

Every HOLINA call is sealed by an on-prem FIPS-204 ML-DSA-87 authority. Paste the call's seal record below to confirm — in your own browser — that the audio and transcript are byte-for-byte what HOLINA signed, and haven't been altered.

The business owner exports this (token-gated) from the HOLINA console. It contains the two signatures + the canonical transcript. It does not need the audio to prove the transcript.
no audio dropped
Drop the .wav too, and we'll re-hash it in-browser and check the bytes against the audio seal.

How this works (honestly). Verification runs entirely in your browser and against the public seal authority — no private key ever leaves the server, and the endpoint only ever checks a signature. A green result means the ML-DSA-87 signature is valid for the exact bytes shown, by the current authority key …. If a call was signed by a rotated/unknown key we say cannot confirm — never a false "tampered".

What a green result does not mean. It means these bytes have not changed since they were sealed. It does not mean the transcript is accurate — that text is produced by automated speech recognition, and a seal can only prove it was never edited afterwards, not that it was right to begin with. That is exactly why the audio is bound to it: so the machine's work can always be checked against its own source.

And the time is not our word. Every seal is folded into a Merkle root that independent RFC-3161 authorities countersign, published at holina-seal-anchors. You can read a timestamp back yourself with openssl ts -reply -in <file>.tsr -text and check it against that authority's certificate rather than ours. Backdating a record would need their key.

Authority public key: /api/seal/pubkey · Learn more at holina.io.