When you land on proof.deepidv.com/a/{id}, you’re looking at the full proof of one specific verification.
Reading the six-step pipeline
Each step has a status badge:- Verified — the check passed. The cryptographic signature, the timestamp, the inclusion proof, the anchor all check out.
- Skipped — applies only to TSA token verification in the SDK
verifyBundle()path, because the SDKs do not ship X.509 chain validation in v1. The explorer always verifies all six steps; only the offline-SDK path skips TSA. - Failed — should never happen for a legitimate attestation. If you see it, something has been tampered with.
What each step means
1
Envelope hash
SHA-256 of the canonicalized (JCS, RFC 8785) envelope JSON. Anchors the rest of the chain — every signature below is over this hash.
2
Issuer signature
ECDSA P-256 signature by the issuer’s KMS-held private key over the envelope hash. Verified against the issuer’s public key, which is in the bundle and on the issuer profile page.
3
Dual RFC 3161 timestamps
Independent timestamp tokens from DigiCert and Sectigo, each binding the envelope hash to a specific moment in time. Either alone is sufficient evidence; both together are belt-and-suspenders.
4
Merkle inclusion
The audit path from this envelope’s leaf to the segment’s STH root. Verifies the envelope is actually in the log — not just claimed to be.
5
Master STH signature
ECDSA P-256 signature by the chain-master key over the STH (root + tree size + timestamp). Verified against
master.pem published on the log page.6
On-chain anchor
The Base L2 transaction hash committing the STH root. Click through to Basescan to confirm the root appears on-chain at the claimed block height.
Label commitments
Each envelope carries a list of labels — structured metadata like country, tier, document type, KYC level. In the bundle and on the detail page, you see:
A label is Revealed when the issuer has chosen to publish the salt alongside the value commitment. The value is then verifiable: take the value, append the salt, hash it, and compare to the commitment in the envelope. If they match, the label is real.
A label is Committed when only the commitment is published. The issuer holds the salt off-chain. They can prove the label’s value to a specific counterparty without revealing it publicly.