Off by default (404 unless OBELISK_SEAL_ATTESTATION=on). When on: the registration's seal verdict as a JWS signed with the key at /.well-known/jwks.json — header typ obelisk-seal+jwt; claims iss, sub (the client id), aud obelisk-seal, state (LIVE | LISTED | SUSPENDED), origins (the sign-in addresses a LIVE registration names), rev, kind, enforced, jti, iat, exp = iat + 24 h, and reason when not LIVE. 404 with no token for an id Obelisk Gate holds no registration for.