Verification

Check a document without asking us

Every document the XDAP platform issues carries a signature. This page publishes what you need to check one, on a host that is not the platform.

Why this copy is here

The platform serves this key itself, and that is not enough. A key handed to you by the same machine that handed you the document proves nothing: whoever could forge the one could serve the other. A second copy is only worth having if it sits somewhere that fails differently, which is why it is here rather than only there.

So compare the fingerprint below against a source that is not this page either — one you were given in person, or that came with a document you already trust. That comparison is the whole mechanism. Everything else on this page is convenience.

Published keys

XDAP document signing key

Signs every document the platform archives. The signature travels beside the file as document.pdf.asc, not inside it.

Fingerprint

BA8D 5C55 237D F64F 0F5D AF25 DC26 EFD8 7060 9C24

User ID: XDAP Document Platform <xdap@xerdi.nl>
Type: OpenPGP, ed25519
Created: 19 August 2026

xdap-signing-key.asc

gpg --import xdap-signing-key.asc
gpg --verify document.pdf.asc document.pdf

A good signature also prints a warning that the key is not certified with a trusted signature. That is expected and it is not a failure: gpg is saying that it cannot tell you who owns the key, only that the document was signed by it. Telling you who owns it is what this page is for, and it is why the fingerprint above matters more than the download does.

XDAP document seal certificate

Seals a PDF from the inside, as a PAdES signature. This is the one a viewer shows you when you open the file.

SHA-256 fingerprint

71:88:48:0D:53:55:3A:36:D2:D6:21:37:5B:3A:19:46:6A:61:92:76:86:E0:7B:CB:0D:58:01:12:5E:89:87:53

Subject: C=NL, O=Xerdi, CN=XDAP Document Seal
Issuer: Itself — the certificate is self-signed
Type: X.509, RSA-3072, sha256WithRSAEncryption
Valid: 26 August 2026 to 26 August 2031

xdap-seal-cert.pem

pdfsig document.pdf

Your viewer will say the validity of the signature is unknown, and will probably show a yellow warning triangle. That is the expected answer and not a fault. The certificate is self-signed, which means no outside authority has vouched for who Xerdi is — the seal claims the document came from XDAP, not that a third party checked our identity. Comparing the SHA-256 above against what your viewer reports is what closes that gap, and it is why this page exists.

Two different things, and which one you need

The key and the certificate do not replace each other, and they answer different questions. The OpenPGP key signs the archived package from the outside: the signature sits beside the file as document.pdf.asc and covers the document together with its attachments and its manifest. Use it when you are checking an archive.

The certificate seals a single PDF from the inside. It travels in the file, so it survives being forwarded on its own, and it is what a PDF viewer reads when it tells you who signed a document. Use it when somebody hands you a PDF.

A seal is timestamped by FPS Policy and Support (BOSA), a qualified trust service provider, chaining to Belgium Root CA6. That answers the one weakness a self-signed certificate has: the certificate is ours, but the clock is not. When a seal was applied is recorded by a qualified third party, whatever you make of the identity behind it.

There is no sealed document on this page to try that on. The examples on the demo page were built for that page and are not signed, and the platform is not publicly reachable yet — so this paragraph describes how the seal works rather than something you can check here today. When a sealed document is published, `pdfsig` on it will show the field, the certificate and the timestamp without needing Adobe.

What a signature does and does not tell you

It tells you the document came from the holder of this key and has not changed by a single byte since. Any edit — including one that looks harmless — makes it a different file and the check fails.

It does not tell you the document is true, approved, or still current. Provenance is not endorsement. A signed document that has been withdrawn is still correctly signed.

Something not adding up?

If a fingerprint does not match, or a signature fails on a document you believe is genuine, we would rather hear about it than not.

Write to us