Check a sealed turn without trusting Meerkat.
Give it a sealed bundle and the published public key. Everything runs here, with the browser's own cryptography. This page cannot make network requests: its security policy forbids them, so nothing you load leaves this machine.
Add the turn record and, if the seal is broken, the page names the claim that changed.
Published meerkat-seal-1 key fingerprint (SPKI SHA-256): df1acf70641f0da9b19420e15f04570e055aa6f1242d0eefdd8f91b09fa94b91
The seal binds every claim's checks into one RFC 6962 Merkle root, signed with ECDSA P-256. This page recomputes the root from the bundle's leaves and checks the signature against the key you supplied; the key's fingerprint must match the one Meerkat publishes. Tamper-evident record, held in a separate account of the same organization. Sealed, signed, verifiable without Meerkat.