Signed publishing

Every Registry publication is integrity-signed.

Every Registry publication is signed with Ed25519 so readers can verify the exact publication bytes. Optional DNS verification is free and creates a time-limited official-source attestation.

A claimed record is signed but not yet domain-proven. Only a current DNS attestation may carry official-source authority.

Registry Certified adds human review, certification, governance, team access, version history, and support. Treat machine-readable certification marks as rollout work until those fields ship on production read surfaces.

A valid signature proves byte integrity. DNS proves domain control. Do not treat every Registry record as verified.