Does verification require the GOVP website?
No. Core verification is local. You need the record and, for the asset check, the asset bytes.
Does a valid signature prove the statement is true?
No. It proves that the matching private key signed the record. Trust and factual evaluation remain separate.
Does GOVP replace SCITT, COSE, DSSE, in-toto or Sigstore?
No. GOVP can bind their output as exact upstream evidence bytes. Their native verifiers still validate their signatures, receipts, certificates, attestations and policies.
Does GOVP store user data?
The protocol has no account or central storage requirement. This site’s browser verifier processes selected files locally.
Can I add a custom field?
Yes. Unknown non-empty fields are preserved and signed. Use stable, documented names and do not conflict with registered fields.
Can I normalize a URL before comparing it?
No. Remote canonical comparison is strict after the verifier’s limited syntax validation. Do not rewrite host, path, percent escapes, port or trailing slash.
Is GOVP-1 stable?
Yes. Incompatible behavior requires a future protocol version.