{
  "issuer": "KXCO",
  "operator": "Knightsbridge Financial Ltd, registered in England and Wales, company number 15684975, trading as KXCO",
  "description": "Post-quantum public keys used by KXCO to sign documents, attestations, webhooks and events. Published at a stable, conventional location so any party can verify a KXCO signature without holding an account and without asking us for the key.",
  "updated": "2026-08-17",
  "algorithmPolicy": {
    "signature": "ML-DSA-65 (NIST FIPS 204), Category 3",
    "keyEncapsulation": "ML-KEM-768 (NIST FIPS 203), Category 3",
    "note": "KXCO is FIPS 203/204/205 aligned at Category 3. KXCO does not claim CNSA 2.0 alignment, which requires Category 5 parameters."
  },
  "keys": [
    {
      "kid": "aa29f37ab7f4b2cf",
      "alg": "ML-DSA-65",
      "standard": "NIST FIPS 204",
      "category": 3,
      "use": "sig",
      "label": "KXCO platform identity",
      "purpose": [
        "webhook signatures (X-KXCO-PQ-Signature, with X-KXCO-PQ-Kid naming this key)",
        "platform attestations surfaced through the chain verification flow"
      ],
      "publicKey": {
        "encoding": "hex",
        "bytes": 1952,
        "value": "648b1e9b142ce625697fcd4d906f2ff0a76560c742e13418735ce9e8c484942fa4a6123490ee79aaabf157790e313506ecd580eb7a0253596bb51095923b5ca9afc82a1f1080dbbbe8b59cf4fe7bde680072e04ad5bf8db97e8b827698f0e35c622037fd617184695120c8379f1f4fec522fdbfb7bcafe0b875703b0726223486e8ce1050e761774045244824f9e61ae55b5a300fb588b9bad522721650cc0b67b489d93a996d023c154414a45f1d726cce5691b66ee348b5e9a3cb1cc38538100bed98508d77e3c8d18f668c40405631d846019c4de91a6c241cab69c041935a2fe121f698e145953498dce7a5cd42ee86abfacb6b5d6c59dc9826a798314d71e0b64c498a05e009da70a58fc377706e6ddf5c478d9e226829bd3c26290b2a81d75ff5916c6219282f75bcef838d22779c5bdbc37e0a99cd4132c3a51538308b54f60b832272ac515681d298367bf47dd8bad7770492550fe6c0c3dcea85101403fb10410cef81a0d3c94823a9326b7e3d703ebefd8215991c7d82a04d7f324dd0b0774a16f5f1a4137b3ceb3b7b49274e56dec0dd6af0ef5c44722e586142b393fdbb8b37bb0d3f65f474bc1e625d4533c23c7a54bb919a9fe81ac2fb9e09f255c406d0a00d55b185877408024ef1cff6b47778d68eb41db17ab39aa2f6d1bc48c1bce97fcc98ddf1e3811a6e847df33503dc0f726154fcf802aa375307a3d426adec3972f25534e81189ab741a6af95526e1fec0a26feb1a25e6a77d3f99e9e08525d4268eb1ea784c430698822be065c646e4f026f92b6f549eb822abb0b6e069da5d4b5d74bcb55b1e33ec88de47370cd61c6901d0689952c0892d764b026b24615bd397e5f0883c3af662f150fd8f82cc20b396aa7cf71914cb3b07481bef6ea14fdb151b722f029e51eace5b56abcffae96777a5da77c7907c903a7fc78110565d5b1b8814cb3cdb13d263b0842509323e11848c42bf40d82968c5b54b1db360846274f46c7be431f12530b50af5a3ace921e43443237ead3e2ea130408be29a465f42ac6d8ee4a8d612692d6626ad35fd1615437ecb0ee7c492b32c0f985a58d4c83860d4793d2c2067d8557fe7aed0edff71098a3b5e1d0f6d277442eac8c2bf9e9cb200fbc70956770661fc150c41345f192f93aaee2417b522a501145468db961fb152416fbac48a38233195ddc9ac971cd03b16059231ca5a3569d822ae79ccdd29c41db7e7420f6d4c33ceb516387d22492315c95980ba7b283fd1a488f6f6f3f63391db527da75004ab465134a7ad0fcbf703170f4b3eb2a883b3c09fb6efd25e7e051eb37ed2feca96d1fcc1bbbe43c1a535c117c27f72f8cbf30e22e870a2dc2dd1e3561a3413c1e3621c274016f9ae0dad619b6ce973f037f5d3cda0e9f242aa3ce9ebcf8d64d7c6e493dc02916ff870159321562032bd7df165470c3cdd9292319a7fdf9c327e6a3767b9b5e841b50322fd2e8f220a2bbba4d9f916e00666bf183592d783f0c648ab2d89d5d3df830b8f5140a4cd8108451612d7d9f2b57c61612ab79816966dfe9baa6974c91b93c74b096b9cc3d490756c3bef6c029962a14aa314ad2b1431ef61269a151bc25042f8e222d40650b6f181f20b6d268c467fe3df92ac21fe62720b69427b8e1b0257990937e9e5cb8da57a111eb432ee024238232f61e06cb64a55237258c861c5e6467f033516212d196fb4c05ca826608ca6afed3635ead33191caa0aca88f5fff2fd526a0277496e04f532aa44ee1d3b8fdaf5fce3b2ce5127c56db216b133e1ac2cf7d4e6c25dd10be950dfa02e1b608a8eb7ea9b434e8232a2d4c969c7d18da8eeec516a29f4c2fc2a42bf3b3b2e761a691438e7c7c755f0169027933b5afacaaa7ce91660c6c30801b47f340d3fad969c25be960649c4b8ef01a60de0a66875f1593e9f9caac3866f51dae1fd8e29163a3e8c5a2b5e1027b5d681c217b20e1a776b363d5fb9d8bd005a39c1c262a0a410e9562bcefe2277350d5a20d6fee04cbfae049fe0ae79c46a247948ad6b011c4b625e50569d013eac3818d543ad37a548212699505bd0450725434beb719b4a3d694ec8b62d4caf195c3eff2a3d5a85108b5e0f06e56aa8ffbd0538700c9a2fe908ee5fe7b916a137204114010566b585756c95ad7c57c22a390054a8fffaebaa737d26b00636a9ab7a2a9d4db206fff132741605c9eeaea24ef54374d23a743784d8807e17710033e9f0f8b2cbef557753f79daf12328de93f7d150325c217824d50ddb309e4bf63dc6ae282d4eddef4f10ddc0d3cf2e63d2e8ecb153093a8c46ce6d3b75733205ac6f672751b81903ebefef255697d98198f9448c2ab58048983adc161a1d8b62db933b9a5a493695c199f784c5ccfef3067a28514fba318e5c8d3f0585ca5b61bcd327474c2c666d767fa6b8c58b8bbb8c26e012a662882e28560bf357b7d8af8c1a170d007fbb23ef6b107b4ad6e44795738bb083d33dbcab6760fdc57925042d4b464a549d64182e50dfe28f670f1bb4dd705b19ce2572bf0244f517e3e455ba973591a1a647221af71ac95c7eb1da016bb1619d8f61c2dd7ff86b9d5fc2a1f991203fcabdd05a1fd737561e2de2e0c7d569ae98ae26cc98ca9ca6211d246f15b0bb64a594b988d7c7f12a8afae285bf5023d4af9acfc0ff9531f6384a5c94f83877f6905e92d6b4ec28b93a5695f68fb63948e6dd8227df8adb04cab50a022d53e15ef6805f4317fef0d1d2418"
      },
      "alsoPublishedAt": "https://kxco.ai/.well-known/kxco-pq-pubkey"
    },
    {
      "kid": "2524850618911a9b",
      "alg": "ML-DSA-65",
      "standard": "NIST FIPS 204",
      "category": 3,
      "use": "sig",
      "label": "KXCO Nexus signing platform (sign.kxco.ai)",
      "purpose": [
        "document signing certificates and evidence records",
        "data room NDA acceptances",
        "CRM on-chain attestations anchored to Armature L1",
        "signed event and webhook deliveries from sign.kxco.ai"
      ],
      "publicKey": {
        "encoding": "hex",
        "bytes": 1952,
        "value": "8deb3090ae93f420fe5a787d6b847118377e8bb2c80c993777152bf1d5558d350ec731f254e868d8bcec73bc8092a7e5db63d2a7cd324cff64e6899603e9fb34fb41f82a327a574fbbcbafff0ffd563b634b7d3938ece7f67cd65504f6e8235342fc570b3ddbb31b8455c5835696be327973ae46ca573ef774b83becfb8675f943e6e54f16c91c7be15ac815d2f20f38fe9eed49bd8ba22bd0cc471022ba4b4d3c24223a1ba640f31df15050dab26e24f06f852562c4f04ee10e7c1b46896f310b693daaf20ede1b1e537fe86174f3b9734c6e80da808b5a705be739500f7725e68436e0dc4b80301bbb2f758da2b33c2142baed12fc45fb9437856ec6be000757f49b70a3ba45e564c598c930ddb3c24955255d8a05e4333e2d96084eb8c0469be464fbd0e19c7ddb205fd313e2f5264d7af09d7f6c2389e28524df1e903c2bc214a37b7cb9a158054f3fa0f9e3652bb0add4e541622eee6b71496aad31b8717f4321b2f63418ec59f92fc36ae4db26c1fc2d50dcb2b169ccc83b61a24d11278a976fda3f504871883cab2050435b4f4f6f650525d44facc94f3531496664d79422804c8d4739ddd6d1119d6b353b935607a6ebe2cca11b3b25139b23cf32b426f67594207870eab61ced9096881dff8eede24e3f71405f8f0a05e87db18bf0e76adff66a68c64963c98227f10c800ec67f0fa276ce08b3f099097687abacda2d678393a3f08ea6e5fc28aa7424e64fd028e7adaad680c8b62ccc41e2a317d1b00dbd4038b7809536f2b1452089d119a84569c5392f2f1276160b1a087d52b502d0c7261f3d5e3cca5b0c7a0e11e98d9f728eb9afe0b7d27591c927f649f1b70c4702c3b8674d2a6ed85c97a9d01adb18656a27d7d0fdf585c4e86ba38b6a0473d20a666b512ff8bb5b2796b941a06e8382f13db9aaca2c8ed67d766b04de099fe2666480718116d6f9cef300ee9d519461dd40f28a59bcf40a43ba4cc8af317a300a84a243f9ef3c3c346ee79012af37c537eba4471e033d21969495c3a3c3555a0328c79d3bae513c1fbc56c50da65dc0b2e3ce4a1693ff37268f7ecfc6b37293dc0c0f368526b0c7ee88027a367a09a46ce79b6de83df55960c78922bfdb46dea100048e6a2c0d616a9ff13c6de1c6a95a7c64340754f5c070f37f80aabc5ec4298aa5fe8d2a564e0520db01c740e40cf974873ef305bf6ace5f3fa0cf9aecd67e8a8b8937dc6c6597d021db2797d06e680b529d958458b6514a3ae8cb44e03581c179f69257732a6c01f5deaf498dbc44dd8e2dc1dafa6258d1baaa02461a58b8f3dcb8b91c66deedc05ebb2517287bc8eaca1f4d2e608302a0db664ca19cb8210dc231969b9cb8099d450dacae72fd581806aedf65f35b2ebb3c542f5f3c880e76a9fecf765708e568e8d2d9fc8dee58bd21f9faa206081e3db3ab2032be8960494f9a2143a8320859fa3b92f552ac9b5fb7f30d9b3a427b4b7b9c5972c9a2f28e8612863cdd85a83dbab43dc4726d727b5e1f82c20689f791f5f2719a5675d210a4e9c7cae341caac815981219f4341e6b6ae709cf76bae0460d3ee2db3b72d2c6a9f12b26f0530b78bdccf7f84ca49c1f9356db1324721f5f0343e77828e43051492f5ce9b031b957f79a55542b3a0a00b85a410179542ec43ef60708de33247cef29240930fceeebcf4354b88b4d06726805057a9f0f9a198eee3fbc43c368da99b7ee6716df30a6700df41d0eac63ba177f3e8e6daa27c299cce6cb5393152f3c1d776193504160d153c813a090bbbaa35a9e6f1b303e41ecc529c3f6f4e756d79bdd36c67a421187cd2e604e834a9226e6f08712f3b77dc5446163ddbc82b1aed3add8bb87b33bad5ed96b9dce42d6c56587126bf73eb720859ec991fbe32842a780144b48780e47760821e0c31ff55ec616f44bfcb116353e5acf39fd5605e0931eb78a7cc10450b0f92f5f1b9a2e0e618ef5d1c76f03bc9aa72cd35cf3a903821b1012336960bbabe302c7e7ca918c26200141fb5e5e7702d69a7572779ca837312086eef0add63a4849981f5fb4d3b0f84844e4237abc25cef99cee5b7b46f8995cc6d9faf94a460e51949501109f3d28e33dda6e85ebb9dd5588bffe00b93cef124b4d29feac5b80dc4ad6f0d957e9c1b68854fd96d21f8fe159a342a4ccac367a0c4f2c0a1bcc173f370bb1c5edc27edcdbc1b0d03468e5b64d32e1b7c09b80919b7ed1e58c5fe1915687e2c9c1717f2c4a2aba60a77c62555b4deabc06902c6c11fa23c2ab7942de13cc37f1836f0618a827575f8fdc867b691f1059b096c30175da81a31ce7f8ebf1878b19b14970630d672ab3bbe9a1c08a8b3e445e80ca384bf5691169d12f62f5c3c9d9bb6deaf363dd1adea89aac35d211e46a81466b5bc83635a06b343f240d9f9e120b9837951f4d21cc90c2964af0050aeba12aa2427f7855bbf3202ea08312d0e9068e08b18103a64ccbe55b990b15686440e60193f3fb57b1e23a40a1abe8e20cd7cb45b5e8155d145f0ce0fc4d06d5ba3810b47c972584b6132c9576a0a29e75de1572e1119b224c756f70a497e5eaeda8a55c38e507ccf2c46b552e6799b4d0dd203070498fca61482b2ee81694cc1519472bef3b366474363932a56e6b0838e8819e75d10150777737e9e93c10e9db2849ab91c219f21682d1270116316514c76b995ee48d3fd747c4cbf526220eb7b4951b28f5e28c7f8cad11b0ec989f83ede7b5940cec8548e2baadc"
      }
    },
    {
      "kid": "1623999978e28714",
      "alg": "ML-DSA-65",
      "standard": "NIST FIPS 204",
      "category": 3,
      "use": "sig",
      "label": "KXCO Mail signing platform (mail.kxco.ai)",
      "purpose": [
        "ML-DSA-65 signatures on every outbound message (X-KXCO-PQ-Signature, X-KXCO-PQ-Kid)",
        "message hash attestations anchored to Armature L1 (purpose: kxco-mail-attestation)"
      ],
      "publicKey": {
        "encoding": "hex",
        "bytes": 1952,
        "value": "b571d7a7112fe32529b914153d22e4a75cb0a39b48046e2ee87410b9fa0121735907e4ec5948224015503d3b8ee04eae278710ec757f13243915890eb03055f1d8cbb6d72fd3da9945d487b9d6e78eb9df209c1cabac1e5c427d7cdadf3efc13b98df0d8ef872b8d8d8fff918485114d4e17dad6289c5372491a5b438ec2e56be47a6c5fc15890189b3b16d683d303c564d278067aca647da68d0457843bdfccc5f44ed96e660ab7c165370c0e29bc77f68f2f6da88a1ed5e88b98a0e2bd749c476fe68538a974149e88c0e024b9526d5c6a1baecd12d34709bb93ae8985540aa4a45b6310b5e6ecdfc02993c13301c83de4b1e4a4a866bab927e7dde827708593f0bb93eadafec55fe02ec26ae40518d8edfc17eab573349e7d28304c810b5e0c52159af6544c9a19ecf785eda72deafabc019dd2c68a92da5653c6b1fbf2224807975b7d4a93f81aa65b271fa0873727515cf1d688dd5042fa4511c2d5d62260148a75a42ba22c1b5c62e092edc523bd06423049e0db460aa1763344a895e9c5a833af8b4400461776a1715ccf31fe877739139af2a41672488781c58c73372f7ba0166be708736c17f7c71473bc1c18a894b1baecc89f9bb2b4fb14c2ebea46882952f1f7593c40c996b37eedd77563c60e2c02a3abdefd300820945a8f03d275b5e47bd1cc8881ef011f8ac915c4415f462b08c1ad035a0f8d787ce2d76cc4b0d590f65978bf7ebda25ba31c8bfe6ccf5bd56a94167a1e52d7d8f22785d3788bbcfa60b77a1f0bad23d769e847efae4391d5bb7b8cc28d07a5f2f1bb2c717bb0802bdd06237f2763468f919646cb7cc1655218ce55be999b5dae98719f2165856b03f17ff8b9a7e6aded8d4bf510c6d7a99b4e08ba2f8e57695095161769fae63826db69919f809d786faf908c3c72083ed0f3ebbfbba7e1aa416c5453d838679b8525454d4d050da98928d36bf051a7b417da4a8caceba41bba8279233bda26d2154635546885407c8881fdf2d1c6574ae55206372496f3cb1410a3dbe7cae59298d6f2d63345d2a4c67b080a2ab0291ab54c84db85082a11ade395c85fd09c0c31ee2657309846260bd9e62d24074088fec471878c40d81d6dad5017f39f565d60862e8c30ab5808d9236c0e901b7923f94f7c87c27d664279970c08cbb8166d50a500051fbecdf8500a495a06fcf69f7fcdf8892abc1a3f483bed9a3bbe20847cedd672391d81f6922da7eaede3dcc0f866f3d97cf6a43a8ad09989cc21173aef4f386772bc2c4dd387efa3fc6eab9d0f2e666eea97db7e33a9c02d2ef249c709cf8e8c751c832dbef10e392e86468e8a80561d4f4f7f75ed3f5e98c3211a4cf1813c926e72252145a1e806788b886cb644797a4cb7629bb0ccc8933dddfe6136d315c27a73d1920a015835d3af575ab129ffd6206e557ec437ccc14f5f25b249eed1378ca6d8233ea0c3ee4b932eb5d0e22de5e54726ec6b24567aa0ffcc38343b3df5c276d549b5db85f402b41f14224ac1cb629ad6b30eb2eb3da1c903cdbe6da2703d8a6d33b3914b99bdf734865a881c422452635398bf863cf7ca487046eef6a50a87f3f1a06cd40b95215831cef49628580cdf03d5670a883020f73a4be641728cb7e11543ae8754ec3f3c86dc37d0ef704b62788751c722d8e710341cf12905b98830bc0504c74c71dedbcb9b8fc6d7a14a63a893d6622805747410c694eb60283e3eda11552ff9e2ef4443d90b7e2d2c4c913662bae865b1cfbee042d2af04079efc14d7960a0bcc3d6156e279110c1869bbe38fb3f59e7ba187647693bc69af172486ec8eeb31d975c900fe528cae19add636b3f067034aa0ebf09ee7c1cf49bd3a8228ccf256947beddab5d6d5a2cf79a61de348ccaaa1a004f5bdd1f89497a4703d1d0c4e749614b045fe8cbb1ae7c60a9df844dad418171289e52b492c010687c8df62195888cd6f39acd4a6cc6dd098f0ea9ff0da25e7173c9de03e6d09506f9b2c06850dca692b50fe1c7b1fbbb168e753d8d0f66311772c3d4e171f401aadcaef33673ebb96ca2d21ae0647ba6edff9b7aae58d19ccf9ec24df0bcad5255c0c25a83caee7f7da67fd9abe92db66362c9adcbc9502b3dc31636a6973a141ac31d55799d1ebf51cf6a691156a710b4c9b47a80b44987ea0b8187f581a2135b792601ecefc23371f71597e73c5c915ee2639061f102315bad603a98af42465faa0056f9781bf225d467659a38fc24a26fcbc7b2b9071a6fbae21cf22d6c7ff222ebf9f8bfbe1f7e46418f97c8d5eed2ca3fb1a064f28fdab2cf5345b6a97dfc79d39073c12444acbf4dcd1a048169001c78e8c294980fdd82520603b2d37d74f45f6324710e75714143a5451c4b9ec72381bbcfea7563f6134af093d9777de189ffa11320b1908e55f3287a15ca6abba64f5f0d67b0aa685648988fb17ee34a21e12e7548d18736bf23831ae9356202eb5420fd220b5e8dbd5203fd36d0cbb4442f279f01eb498725787daa592b9663f7500a0944c5e192be881dbbdad1eeb61970afdf8e69cab1360e5b7d54dd8c10502a213283a3c580115317acd3ac2ac16e80f90c9a57415d6c4ed071777d979cda15af431c1bd7aefeaf3f4f0f315ddf1c3c3369e6a12a73726275906171219e3022f4f6b651bf72462baf81d6d58a5366a2917dbae604bd5166cccdea68a925717c5e0bc67b5428008b854f884831c563cc68a41bc8ada4814e98930e6ed019d6395bcc45e66"
      }
    }
  ],
  "kidDerivation": "first 8 bytes of SHA-256(publicKey), hex encoded, 16 hex characters",
  "verification": {
    "library": "https://www.npmjs.com/package/kxco-post-quantum",
    "standalone": "https://www.npmjs.com/package/kxco-verify",
    "service": "https://verify.kxco.ai",
    "anchorChain": "https://chain.kxco.ai",
    "howTo": "Read the kid from the signature header, select the matching key below, sha256 the payload exactly as delivered, then verify the ML-DSA-65 signature over that digest."
  },
  "rotation": {
    "policy": "Scheduled rotation at most quarterly. Emergency rotation on suspected compromise.",
    "retention": "Superseded kids remain listed so historical signatures stay verifiable."
  },
  "scope": "Signing keys only. ML-KEM-768 encapsulation keys are per-vault and are not required to verify a KXCO signature, so they are not published here.",
  "contact": {
    "security": "john@knightsbridgelaw.com",
    "disclosure": "https://kxco.ai/security"
  }
}