The open party tool. Apache-2.0. Three verbs: verify, init, trigger.

verify requires no account, no network, and nothing from the issuer. A
test asserts that by making socket calls raise, because the claim that
anyone can check a Receipt independently is worth exactly what the
ability to do it is worth.

Keys are arguments and there is no code path that fetches one. The caller
decides which keys are acceptable before the Receipt is read, so a
Receipt cannot nominate the key that judges it. ds:RetrievalMethod, jku
and x5u all invite the opposite, and the failure is quiet.

Canonicalization is a thin re-export of sdcgovernance.jcs. A second RFC
8785 implementation can disagree with the first, silently, which turns a
structural guarantee into a testing problem defended forever.

init reduces onboarding to publishing one JSON file. trigger signs to
stdout and stops; submitting is a side effect behind --submit.

Ships the issuer's ten conformance vectors and runs against them, each
required to fail on the check its manifest names.

MAJOR tracks the SDC reference model, so 4.x.x targets SDC4.