{"product_id":"ostensor-potted","title":"Ostensor Potted","description":"\u003ch2\u003eWhat you were shown is what got signed.\u003c\/h2\u003e\n\u003cp\u003eLatin, \u003cem\u003eone who shows\u003c\/em\u003e. The only device in the line that addresses the hardest problem: a secure domain owns both the display and the key, so a compromised application can’t show you one thing and sign another. \u003cstrong\u003eOne physical press permits at most one signature.\u003c\/strong\u003e\u003c\/p\u003e\n\u003ch2\u003eSpecifications\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSTM32U585 + Infineon OPTIGA Trust M secure element\u003c\/li\u003e\n\u003cli\u003eDisplay and key share one secure domain — show-then-confirm signing\u003c\/li\u003e\n\u003cli\u003eOne press, at most one signature\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003ePotted:\u003c\/strong\u003e cast in clear resin like the rest of the line; serialized, with a record on the public rail. The same board is also sold unpotted as \u003ca href=\"https:\/\/shop.zknot.io\/products\/ostensor\"\u003eOstensor Bare\u003c\/a\u003e.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eRead before buying\u003c\/h2\u003e\n\u003cp\u003eShow-then-confirm is proven on the bench. \u003cstrong\u003eOn shipping units the security hardening that would make it enforceable against a compromised application is not yet switched on\u003c\/strong\u003e — the mechanism is present, the lock is not. We say which when it changes.\u003c\/p\u003e\n\u003ch2\u003eAvailability\u003c\/h2\u003e\n\u003cp\u003e\u003cstrong\u003eShipping now\u003c\/strong\u003e, in small runs. Flagship of the line.\u003c\/p\u003e\n\u003ch2\u003eTry one before you buy one\u003c\/h2\u003e\n\u003cp\u003eEvery attestation device signs a challenge and the record is checked in your browser at \u003ca href=\"https:\/\/verifyknot.io\/start\" rel=\"noopener noreferrer\" target=\"_blank\"\u003everifyknot.io\/start\u003c\/a\u003e — no account, no login. The verdict is computed from the record itself, not handed down by our server.\u003c\/p\u003e\n\u003ch2\u003eWhat it does not do\u003c\/h2\u003e\n\u003cp\u003eA signature proves that a specific key signed specific bytes. On its own it does not prove who held the key, that a person was present, or that the contents are true. Each rung of the line adds one of those, and we say which. The timestamp on a record is ours, not an outside authority’s. Tamper-evident, not tamper-proof.\u003c\/p\u003e\n\u003cp\u003eHand-built in small runs in Utah · veteran-owned (SDVOSB) · US shipping with tracking · \u003ca href=\"https:\/\/zknot.io\/returns\" rel=\"noopener noreferrer\" target=\"_blank\"\u003ereturns\u003c\/a\u003e\u003c\/p\u003e","brand":"ZKNOT","offers":[{"title":"Default Title","offer_id":54326901014639,"sku":"OS-1","price":199.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0720\/0492\/7599\/files\/powerverify-9028799.jpg?v=1789879987","url":"https:\/\/shop.zknot.io\/products\/ostensor-potted","provider":"ZKNOT","version":"1.0","type":"link"}