pqc-cometbft-sidecar: sample checkpoint certificate
====================================================

cosmoshub-4-33481570.pqcc is a real certificate produced by pqc-cometbft-sidecar v0.1.0
while following Cosmos Hub (cosmoshub-4) on 2026-10-19. It was signed with a throwaway test
key made for that run. public_key.hex is that key's public half (ML-DSA-65, 1,952 bytes,
standard FIPS 204 encoding, hex).

  chain_id         cosmoshub-4
  height           33481570
  block_hash       91281693E90F966B0ECA71AE6E75B395240CDBFDC35BF070574F8ED424A0BD69
  validators_hash  3681875D72D3108C22349440665FD00E809E2E899014EF8F1E126E25FFE01A9B
  key_id           a77aae4fbe5b5945077f9368be0584af1ee3360fcf9888a58a8f4e923dbf50ef
  size             3,438 bytes

Verify it yourself in three steps
---------------------------------

1. Install an independent ML-DSA implementation (no sidecar code is involved):

     pip install dilithium-py

2. Check the signature:

     python3 verify_sample.py cosmoshub-4-33481570.pqcc public_key.hex

   It should print "signature VALID (ML-DSA-65, FIPS 204)". Change any byte of the
   certificate and it prints INVALID.

3. Check that the certificate refers to the real block. Look up Cosmos Hub block 33481570 on
   any explorer, or ask any public RPC node:

     curl -s "https://cosmos-rpc.publicnode.com/commit?height=33481570"

   result.signed_header.commit.block_id.hash and result.signed_header.header.validators_hash
   must equal the block_hash and validators_hash printed in step 2.
   (Pruning nodes eventually drop old heights; an archive node or explorer always works.)

Any other FIPS 204 library works too (liboqs, Bouncy Castle, the RustCrypto ml-dsa crate).
FORMAT.txt has the exact byte layout and the signed message.

What this certificate proves, and what it does not
--------------------------------------------------

It proves that the holder of this ML-DSA-65 key attested to (chain, height, block hash,
validator-set hash). It does not by itself prove that Cosmos Hub's validators finalized the
block: the sidecar trusts the CometBFT node it follows. Verifiers pin the operator's public
key out of band. This sample's key is a public test key, so the sample shows the format and the
verification path. It is not a trust anchor.
