The Ed25519 public keys Attestwire signs with

A JWK Set (RFC 7517) of the Ed25519 public keys this deployment signs with. Free, unauthenticated, open to any origin, and cacheable for a day while a key is published (five minutes while none is).

Every Ed25519 signature Attestwire hands out names its key by key_id; find the entry whose kid matches and verify with any Ed25519 library, OpenSSL 3 (pem), or node:crypto. kid is the key's own RFC 7638 thumbprint, so you can recompute it from x. status is active for the key that signs today and retired for keys kept so that what they signed can still be checked. Meeting a key_id you have not seen means the key was rotated: fetch the set again.

Take the keys from this address. A key or a URL that travels with the thing you are checking proves nothing about who made it.

A deployment with no signing key configured answers keys: [] and a note, and nothing it issues carries an Ed25519 signature — every response that would have carried one says it is unsigned instead.