02-TRUST
How signatures work here
We follow the intents.md trust rules: a signature never hides a document, it tells you who vouches for it.
Unsigned
Anyone can pitch. Their answers show as claimed by the supplier.
✓ Self-signed
A supplier signs with its own key: a steady identity across pitches, and any edit shows. No domain vouches for it.
✓ Signed · their own domain
A supplier on its own domain signs as itself. The strongest badge on the board.
A signature proves which domain vouches for an offer. It doesn't prove a certificate is real: ask for the certificate before you order.
Our verifier policy
Algorithm
Ed25519 over the canonical form (02-TRUST §4.1). Other algorithms show as unverified, never hidden.
Key
Fetched only from https://<registrable domain>/.well-known/intents-md/key.asc (PEM or raw base64), never from the key: line. keyid = sha256 of the raw public key.
Fetch
https only, plain DNS names (no IP literals or private names), 1 redirect for keys and 3 for documents, 64 KB keys, 256 KB documents, 10 s, keys cached 24 h.
Free hosts
Capped at self-signed (L1): github.io, gitlab.io, codeberg.page, pages.dev, workers.dev, r2.dev, trycloudflare.com, netlify.app, vercel.app, web.app, firebaseapp.com, herokuapp.com, onrender.com, fly.dev, glitch.me, neocities.org, surge.sh, replit.app, repl.co, deno.dev, azurewebsites.net, blogspot.com, wordpress.com, wixsite.com, webflow.io, framer.app, framer.website, carrd.co, notion.site, super.site, ngrok.io, ngrok-free.app, ngrok.app, myshopify.com, squarespace.com, weebly.com, jimdosite.com, jimdofree.com, strikingly.com, godaddysites.com, site123.me.
Suffix list
pickthepitch subset 2026-10-19: a pinned subset of the Public Suffix List; any other name counts as label.tld.
Freshness
A signature older than 400 days shows as signed but stale.
Our key
Every confirmed request is signed "Signed · pickthepitch.com": a real inbox confirmed it and nothing changed since.
Ranking
Pitches signed by a domain first, then self-signed, then unsigned; within a tier, oldest first.
key.asc