Verify who you are talking to.

01 / THE CEREMONY — THIRTY SECONDS

One ceremony per contact, once QERYX arrives.

1. Know what the safety number is

   Your safety number is a short fingerprint computed with HKDF-SHA-512 over your session root and both peers' ML-DSA-87 identity public keys, sorted so both devices derive the same bytes. At the in-person connect ceremony — before a session exists — the same fingerprint is computed over the two identity keys alone.

2. Compare the safety number out-of-band

   In person, over a voice call you already trust, or across any channel an attacker in this one does not control. Both devices must derive the same number.

3. Keep the match

   The verified state persists. From then on, a key change on their side will surface as a visible event in the conversation — never a silent swap.

02 / BETWEEN CEREMONIES

Let the log watch while you are not looking.

Every identity key lives in the key transparency log: an append-only record signed with ML-DSA-87, cross-checked by a 2-of-3 multi-witness quorum that starts dormant — all three ML-DSA-87 slots and all three external Ed25519 auditor slots hold placeholder keys, so no cosignature is carried and no witness check runs yet. Every root, until the witnesses enroll, is signed by one operator ML-DSA-87 key, which your device verifies against a SHA-384 anchor compiled into the app and cross-checks peer-to-peer through gossiped log roots. Enrolling a witness takes a new app release, by design. A server that showed you one key and your contact another would be caught by the log's own math.