Sign in
Servers

Get Signing Keys

Return the signed key bundle used by booting VMs to fetch and verify cosign/Helm keys.

Each entry in 'keys' is a base64-encoded public key; the corresponding entry in 'signatures' is a base64-encoded RSA signature (PKCS#1 v1.5 over SHA-256) produced offline by the root signing key in Cloud KMS. Nothing here can sign; this only serves. Intentionally public — no mTLS required. Independent third parties and auditors can fetch these public keys to verify TDX quotes without needing to be a VM client.

get/servers/signing-keys

Response

Successful Response

{"stackTrail":"paths:/servers/signing-keys:get:responses:200:content:application/json:schema","oasType":"schema","type":"unknown"}

Changes

Changed in 3 of the 11 revisions of this API.12