Ostensor Potted

What you were shown is what got signed.

Latin, one who shows. The only device in the line that addresses the hardest problem: a secure domain owns both the display and the key, so a compromised application can’t show you one thing and sign another. One physical press permits at most one signature.

Specifications

• STM32U585 + Infineon OPTIGA Trust M secure element
• Display and key share one secure domain — show-then-confirm signing
• One press, at most one signature
• Potted: cast in clear resin like the rest of the line; serialized, with a record on the public rail. The same board is also sold unpotted as Ostensor Bare.

Read before buying

Show-then-confirm is proven on the bench. On shipping units the security hardening that would make it enforceable against a compromised application is not yet switched on — the mechanism is present, the lock is not. We say which when it changes.

Availability

Shipping now, in small runs. Flagship of the line.

Try one before you buy one

Every attestation device signs a challenge and the record is checked in your browser at verifyknot.io/start — no account, no login. The verdict is computed from the record itself, not handed down by our server.

What it does not do

A signature proves that a specific key signed specific bytes. On its own it does not prove who held the key, that a person was present, or that the contents are true. Each rung of the line adds one of those, and we say which. The timestamp on a record is ours, not an outside authority’s. Tamper-evident, not tamper-proof.

Hand-built in small runs in Utah · veteran-owned (SDVOSB) · US shipping with tracking · returns