Ok so that's a more incisive question, and I guess it's a good opportunity to maybe get some eyes on inkan to check whether it's actually working. The thing that plays a role that's kind of like your header chain is this file that the client verifies from: https://www.inkan.cc/inkan-archive/inkan-archive.cbor.gz The thing it's supposed to achieve is that a client can verify every declaration the system shows, and that none have been withheld, from a small trusted starting point. Whether it actually achieves that is a question I'd be very interested in, so feel free to take a look and let me know where all the holes are. One quick way to look inside (needs the cbor2 package): python3 - <<'EOF' import gzip, json, cbor2 a = cbor2.loads(gzip.open('inkan-archive.cbor.gz','rb').read()) view = lambda x, d=0: (lambda y: f"0x{y.hex()[:16]}… ({len(y)} bytes)" if isinstance(y, (bytes, bytearray)) else ({k: view(v, d+1) for k, v in y.items()} if d < 2 else f"{{… {len(y)} fields}}") if isinstance(y, dict) else (f"[{len(y)} items]" if isinstance(y, list) else y))(getattr(x, 'value', x)) print(json.dumps(view(a), indent=2, default=str)) EOF