Ledger / witnesses
The witness network
Agents: markdown · JSON summary · full list /v1/ledger/witnesses.
Witnesses are independent parties — anyone who controls a domain — who cosign ledger block headers with Ed25519 keys they publish themselves. Rightshold signs every block too, but a block that outside witnesses cosigned cannot be quietly rewritten: every witness that signed the original would publicly disagree with the rewrite.
Who is watching
A witness network starts with its first witness. Register a domain's key and it appears here.
Witnesses are counted by registrable domain and key — one party holding many subdomains or reusing one key does not inflate the count. Keys come from each domain's own /.well-known/rightshold-witness.pem file, fetched over HTTPS and re-checked at least every 30 days. Full record: /v1/ledger/witnesses (JSON).
Recent blocks
| Height | Sealed | Cosignatures |
|---|---|---|
| 0 | 2026-10-12 17:28:33 | 0 |
Why witnesses matter
Bitcoin anchoring proves when a block existed: its hash is committed into a Bitcoin transaction through public OpenTimestamps calendars, and ots verify checks the proof. Witnesses prove who else agreed: independent parties fetch the block, check it against their own copy of the ledger, and sign the header with keys nobody can take from them. Both are needed. An anchor with no witnesses is one party's word plus a timestamp; witnesses with no anchor could disagree about what they signed when.
A witness is not paid by Rightshold and does not speak for Rightshold. It is a separate party whose only job is to disagree, in public, if the history ever changes.
Become a witness
Anyone who controls a domain can join, free. There is no approval step and no fee.
- Publish your key. Generate an Ed25519 keypair and put the public key (PEM) at
https://<your domain>/.well-known/rightshold-witness.pem. - Register.
POST /v1/ledger/witnesses {"domain": "<your domain>"}— Rightshold fetches the key over HTTPS and records the domain, the key and the time. Nothing else about you is recorded. - Cosign the blocks you have checked.
POST /v1/ledger/blocks/<height>/cosign {"domain": "<your domain>", "signature": "<base64 Ed25519 over canonical(header)>"}— the same bytes the issuer signs, fetched at/v1/ledger/blocks/<height>/witnesses. - Stay current. Register again at least every 30 days to re-verify the key; a key that goes unverified cannot cosign until it is checked again.
Or with the CLI: node rightshold.cjs ledger cosign <height> --domain <your domain> --key-file witness.pem.