MYCDIC PUBLIC PDF INTEGRITY ARCHITECTURE
=======================================

This directory contains PUBLIC verification material only.

- pdf-integrity-registry.json
  Public metadata for the controlled PDFs in the website, including the final
  SHA-256, source fingerprint, reference, detached document signature and
  verification URL.

- pdf-integrity-registry.sig
  Detached RSA-3072/SHA-256 signature of the exact registry JSON bytes.

- MYCDIC_PDF_SIGNING_PUBLIC_KEY.pem
  Public verification key. It is safe to publish. The private signing key is
  NOT included in the website package.

- royal-text-preservation-report.json
  QA evidence confirming that all original extracted Royal Message text remains
  present in the same page order after the MYCDIC verification layer was added.

- pdf-page-digital-layer-qa.json
  QA evidence confirming the per-page digital footer / QR layer and the
  institutional annexes for non-Royal PDFs.

Verification flow:
1. Verify the signed public registry using the bundled public key.
2. Verify the document-level detached RSA signature.
3. Hash the live PDF with SHA-256 and compare it to the signed registry.
4. Display VALID only when all required checks pass.

The private signing key must remain outside public_html and outside downloadable
website archives.
