Question 1

Does a verified COA mean the product is safe or pure?

Accepted Answer

No. COA Verification Registry proves a certificate's origin, integrity, and existence - it does not evaluate the chemistry behind it, and it makes no safety, purity, or fitness claim about any material. A verified COA tells you the report is authentic and unaltered; judging the result is still up to you and your own diligence.

Question 2

What stops a lab from signing a false report?

Accepted Answer

Nothing cryptographic - and we don't pretend otherwise. What COA Verification Registry adds is permanent attribution: every report is bound to a specific, accreditation-verified lab key. A lab that signs something false does so under its own name, on the record, forever. That accountability is the deterrent; the math just makes it undeniable.

Question 3

Could COA Verification Registry secretly alter, remove, or backdate a record?

Accepted Answer

No. Every record enters a public, append-only Merkle log whose head is periodically anchored to Bitcoin. Altering or removing a past record would break the log's math, and backdating is impossible because the anchor inherits Bitcoin's block timing. The platform is deliberately not a trusted party here.

Question 4

Do you hold our lab's private keys?

Accepted Answer

Never. Labs generate their keypair locally and register only the public key, proving control with a one-time signed challenge. There is no point in the system where a lab's private key is transmitted to or stored by COA Verification Registry. Signing always happens on the lab's side.

Question 5

What does “no record found” actually mean?

Accepted Answer

That this batch was never filed with COA Verification Registry. It isn't proof of wrongdoing - but for a product that claims third-party testing, the absence of a verifiable record is a meaningful red flag. Our guidance is simple: if there's no record, regard the COA as unverified.

Question 6

Can I verify a record without trusting your website?

Accepted Answer

Yes. Verification codes carry a signed, domain-independent token, and the canonicalization, hashing, and signature rules are published as conformance vectors. You can reproduce any result - composite hash, signature check, log inclusion - with your own implementation against the open spec.