Signed Posts
Signed Posts allows authors to sign posts, assuring content integrity. Signature verification proves post-signing alteration hasn’t occurred. Features: In-browser verification: The signature verification is done on the client side (in the visitor’s browser). Methods: OpenPGP (ASCII-armored detached
About this tool.
Signed Posts allows authors to sign posts, assuring content integrity. Signature verification proves post-signing alteration hasn’t occurred.
Features:
- In-browser verification: The signature verification is done on the client side (in the visitor’s browser).
- Methods: OpenPGP (ASCII-armored detached signature) and DID (did:key, did:web) using Ed25519 detached JWS (b64=false).
- Source of trust: For OpenPGP, the author specifies the URL of their public key in their profile. For DID, the author sets their DID (did:key or did:web). For did:web, the plugin fetches https://<host>/.well-known/did.json .
- Status block: An informative block is automatically added to the end of each signed article, showing the verification status (valid, invalid, or error).
- Author badge: The author name in posts is enhanced with an icon and KeyID/fingerprint text.
Source Code and Libraries
OpenPGP.js * Version: 6.2.2 * License: LGPL-3.0-or-later * Public Source Code: https://github.com/openpgpjs/openpgpjs
Web Crypto API * Used to verify Ed25519 signatures for DID.
Getting started.
- 01Go to Plugins > Add New Plugin .
- 02Search for Signed Posts .
- 03Install and activate the Signed Posts plugin.
Frequently asked questions.
How do I get the content of my post to sign it?
Once you’ve finished your post, click the three dots in the top-right corner of the Gutenberg editor. When the options menu opens, select “Copy all blocks.” That is the content you should sign.
Where can I host my OpenPGP public key?
You can host it on any service that offers direct links and allows CORS (Cross-Origin Resource Sharing) access.
What happens if the signature isn’t valid?
The plugin will display a warning message indicating that the signature doesn’t match the content or the public key, which can be a sign of content tampering.
