What this proof reinforces

This proof reinforces how H33-Key holds keys — the provider credential is unlocked and stored into H33-Key so the plaintext is never seen, never pasted, and never stored by your team. What you copy is the reference; the secret is used without being exposed.

How to read what you saw: the ML-DSA-65 envelopes are a recorded run — a validated fixture loaded from archive.json. The verification is genuinely live: the SHA3-256 hash chain is recomputed in your browser and the tamper scene flips a real byte and re-derives a real mismatch. So the receipts are recorded, but their integrity is proven here and now, not asserted.

Reproduction path: signed envelopes + root verifying key → recompute SHA3-256 chain → check ML-DSA-65 signatures offline. Do it yourself at /verify/ or read how independent verification works. See the same story as a narrative walkthrough in H33-Key — Stop Copying Secrets, or the customer angle in Credential-Stuffing Defense and H33-Key Universal Encryption.