Integrity Verification

Step 1: It downloads manifest.json , manifest.sig , and integrity_pubkey.pem .
Step 2: It verifies the Ed25519 signature over the exact manifest bytes.
Step 3: It downloads each listed file, computes SHA-256 in your browser, and compares with the manifest hash.

If an attacker can change both site files and the trusted public key shown here, this check can be bypassed.

This only verifies listed static files; it does not prove endpoint trust, runtime browser integrity, or network privacy metadata.

It is a trust signal, not a replacement for transport security, secure infrastructure, and protocol-level cryptography.