demo · v141

Signature Integrity

Generate a real Ed25519 keypair in the browser, sign a fetched response body, then verify the signature client-side. The UI walks through the exact handshake the new integrity="ed25519-…" attribute will perform inside the network stack.

probing Web Crypto Ed25519…
No verification yet.

the attribute

<script src="https://cdn.example.com/analytics.js"
        crossorigin="anonymous"
        integrity="ed25519-aWQt5kV9F0d…="></script>

# On the server:
HTTP/1.1 200 OK
Content-Type: application/javascript
Signature: sig1=:MEUCIQDv...:
Signature-Input: sig1=();alg="ed25519";keyid="cdn-v2"

# Chrome 141 verifies that the Signature header matches the
# Ed25519 key in `integrity=` before executing the script.

see also