Verify any signed artifact

All cryptography runs in your browser using jose + SubtleCrypto. The page only fetches the public key history from https://vault.ledgix.dev/.well-known/jwks.json — no private state crosses the wire.