Is this the report that was issued?
Every Strickle Works report and data file is signed with one key, published on this page. Anyone holding a copy can check it offline with ssh-keygen, which you already have, without my tooling and without taking my word for it.
The key
An Ed25519 key, signing as hello@strickleworks.com. Its fingerprint:
SHA256:AWkWBE/VP3u1F6tbkQi2CdVpeoHNTLGego31vtb1dtc
The line ssh-keygen reads to trust it, called an allowed signers line:
hello@strickleworks.com namespaces="file" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEiI+MZHCtVYgxTdEdMEB7DJ1SQmwbV74mvg4fqp12pY
Check a file
Each file comes with a signature beside it, the same name ending in
.sig. In the folder that holds both, run these two commands, with
your file's name in place of report.pdf:
echo 'hello@strickleworks.com namespaces="file" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEiI+MZHCtVYgxTdEdMEB7DJ1SQmwbV74mvg4fqp12pY' > allowed_signers ssh-keygen -Y verify -f allowed_signers -I hello@strickleworks.com \ -n file -s report.pdf.sig < report.pdf
A file that is the one I issued prints:
Good "file" signature for hello@strickleworks.com with ED25519 key SHA256:AWkWBE/VP3u1F6tbkQi2CdVpeoHNTLGego31vtb1dtc
A file changed by even one byte prints Signature verification failed
and exits with an error.
What it tells you
A good signature says the file is byte for byte the one I issued, and that nobody, me included, has edited it since. It does not say the findings are right. The report gives the reasoning for each one, so you can judge that part yourself.
If a check fails, treat the file as not the one I issued, and write to hello@strickleworks.com.