# verification-service dev secret — EXAMPLE ONLY.
#
# This file is a template. The real cluster Secret MUST be created either
# as a SealedSecret (preferred, see deploy/verification-service/README.md)
# or applied imperatively with values that never land in the git repo.
#
# Secret shape (Phase 1):
#   VERIFICATION_SIGNER_KEYS  — comma- / newline-separated keyid=<enc>:<data>
#                               loaded into the in-memory keyring.
#                               Encodings: pem | hex | b64 | b64u.
#
# The verifier itself does not reach OpenBao Transit in Phase 1; it only
# needs the public halves of the approval and transform signers to
# validate DSSE envelopes it pulls from the transparency-log.
apiVersion: v1
kind: Secret
metadata:
  name: verification-service-dev
  namespace: agent-trust
  labels:
    app.kubernetes.io/name: verification-service
    app.kubernetes.io/part-of: proofedmesh
    proofedmesh.basicstack.de/mode: dev
type: Opaque
stringData:
  VERIFICATION_SIGNER_KEYS: |
    trust-api/approval-signer-2026-q4=pem:REPLACE_WITH_PEM_PUBLIC_KEY
    trust-api/agent-testagent-transform-2026-q4=hex:REPLACE_WITH_64_HEX_PUBLIC_KEY