Handoff - 2026-09-03 - pdf-signing-verify-page

Goal: Publish Anshid’s public PDF-signing certificate + verification instructions so recipients of signed PDFs can check them. Status: shipped (committed, not pushed)

Context

Anshid now digitally signs every PDF he shares with an invisible signature (pyHanko, self-signed cert on his machine at ~/.pdfsign/). This site hosts the public half so anyone can verify.

Done

assets/anshid-cert.pem + assets/anshid-cert.cer (DER) — the public signing cert.
verify.md — new page, layout: page, permalink: /verify/, sitemap: false. Explains invisible signatures, links both cert files, shows SHA-256 / SHA-1 fingerprints + validity, gives verify steps for Acrobat / pyHanko / pdfsig. Styled with one modern-card (mirrors certifications.md); not in the nav.
_includes/footer.html — added “Verify Signatures” link to .footer-links.
AGENTS.md + CLAUDE.md — noted the new assets + /verify/ page in “Static Assets”.

State / deployed

Cert: CN=Anshid Aboobacker, valid 2026-09-03 → 2036-08-31, SHA-256 7D:21:C7:F4:80:90:7C:76:95:FD:3F:4C:E2:88:B8:5D:EC:A9:B9:C5:66:32:E4:B3:74:BD:B0:8A:DB:12:BF:1E.
Committed on main in its own commit; not pushed. /verify/ is live only after push (GitHub Pages builds it — no local Ruby/Jekyll here to pre-build).

Open threads / next steps

Push when ready.
On cert renewal (near 2036, or key loss): re-copy anshid-cert.pem, regenerate .cer, update fingerprints + dates in verify.md. Procedure in ~/.pdfsign/SIGNING.md on Anshid’s machine.

Blockers / watch-outs

Could not run jekyll build locally (no Ruby toolchain / Gemfile). verify.md front matter + Liquid were eyeballed against certifications.md; confirm the page renders after the first Pages build.