Witness Watch

A log's checkpoints are signed by its own operator, so a malicious or compromised operator can keep two sets of books — each reader gets a copy that verifies — with little chance of detection. A witness is an outsider who remembers what they signed and refuses to sign a second history. We'll be that witness for your log, for free.

How it works

01Email us three things Your origin line, your public key, your checkpoint URL — [email protected].

02We check and pin Same day, against the rules below. We pin your key from your page, not your log — so nobody can swap it by editing the log.

03We start cosigning Every checkpoint you publish, from then on. Your badge turns green and shows your witnessed size, live.

A human grants membership, not a form — a badge you could mint for yourself is just self-attestation with extra steps. The only technical requirement is serving c2sp.org/tlog-checkpoint; log-server gets you there in an afternoon.

The rules

Public, so a badge means the same thing everywhere:

Your log serves c2sp.org/tlog-checkpoint notes at a stable URL. No checkpoint, nothing to cosign.
Your key lives on your own page, and that's where we pin it from — a log that served its own key could also swap it.
The origin line never changes. A new origin is a new log.
We only cosign histories that extend what we already signed. Forks and rollbacks get refused, on the record.
You can leave; the cosignatures we already gave don't. History doesn't unhappen.

Your badge

Type your origin. The badge renders live from our cosign table — it goes green with your tree size when we're actually signing you, and not before. The page has no say in it.

Member logs

Every log we currently stand behind, straight from the cosign table:

loading…

We watch the witnesses too

Witnesses need watching too — a witness that signed inconsistent statements to different parties would otherwise go unnoticed. Every witness on the shared network on the shared network gets polled hourly through the tlog-witness monitoring API; we verify each cosignature against pinned keys, archive every answer, and compare them across the fleet. As far as we can tell, it's the first time anyone has compared two witnesses' answers. Operator alerts are free — ask.

Beyond one witness

One witness is a start. When you want a quorum, enroll on the shared list at witness-network.org/participate and the network's witnesses pick you up automatically. It's where our own seven came from.

A cosignature says your history was never rewritten. It says nothing about whether your records are true.