Post-quantum key transparency · managed

Prove your keys haven't been swapped.

mosskeys is a managed, post-quantum, privacy-preserving key directory. Publish verifiable, append-only key histories for your users, services, agents, and robots — and let anyone verify them, without leaking who's in your system.

Start building Read the docs

ML-KEM · ML-DSA · CONIKS-style VRF privacy · tlog-tiles compatible

mosskeys verify --label alice@example.com

✓ inclusion proof verified
✓ consistency proof verified
✓ checkpoint co-signed by 3 witnesses

  suite   ML-DSA-87 + Ed25519 (hybrid)
  leaf    #48,213
  root    0x9acf…e8e8

→ key history is append-only and tamper-evident

Why mosskeys

A finished key directory, not a pile of crypto

Tessera is the public log substrate you run yourself. mosskeys is the managed, post-quantum, private directory you don't have to — interoperable with the same witness ecosystem.

Tamper-evident history

Every key rotation is appended to an RFC 6962 verifiable log with inclusion and consistency proofs. Rewrites are mathematically detectable.

Private by design

VRF-blinded CONIKS lookups prove a key's presence or absence without exposing any other identity in the response. Private keys never leave your devices.

Post-quantum native

Hybrid ML-KEM + ML-DSA with classical fallbacks. Built PQ-first so you never have to re-migrate your identity fabric in three years.

People, agents & robots

One directory for users, services, AI agents, and robots. Prove an agent's keys and capability history weren't silently rewritten — and verify it offline, at the edge.

Witnessed for you

On Pro, mosskeys automatically relays each signed checkpoint to the independent C2SP witnesses configured for the service, and any returned cosignatures are merged in and shown on the checkpoint. No trust-me-bro roots.

Verify anywhere

A WASM verification SDK and an Elixir NIF over one audited Rust core, plus native Swift, Kotlin, and Python verifiers generated from that same core via UniFFI and published to SwiftPM, Maven Central, and PyPI. Clients verify proofs themselves; the server is just a dumb, honest store.

Max PQ security level: Cat-5

Proof verification: < 5 ms

Client-side verifiable: 100%

Private keys server-side: 0

Open core

Ship verifiable identity, today.

The verification libraries are open source. The managed, witness-ready, post-quantum directory is one command away.

terminal

brew install moss-piglet/mosskeys-cli/mosskeys-cli   # macOS; or: cargo install mosskeys-cli
mosskeys config set-token   # msk_live_…
mosskeys keygen --label you@example.com

On Linux or Windows? Use cargo install mosskeys-cli, grab a signed binary from the GitHub releases, or see the install guide.

Create an account Talk to us