eNotary: Notary signs new key binding certificate #970

Closed
#972
Closed
eNotary: Notary signs new key binding certificate#970
#972
Assignees
coodos
Labels
enhancementNew feature or request

Description

@plansombl
plansombl
bot
opened on May 23, 2026

Description

Inside the eNotary software, a notary must be able to sign a newly generated key binding certificate. This allows a fresh cryptographic key to be officially bound and attested by the notary, establishing trust for downstream consumers of the certificate (e.g. eID wallets, eVault access).

Reference

  • Related to the eID Wallet passphrase-free recovery flow (see companion issue).

Acceptance Criteria

  • The eNotary UI presents a clear workflow for a notary to review and sign a new key binding certificate.
  • The signed certificate is cryptographically valid and includes the notary's signature over the new public key and binding metadata.
  • The resulting certificate is exportable / storable in a format consumable by the rest of the MetaState ecosystem.
  • Signing is gated behind proper notary authentication (the notary must be authenticated before signing).
  • Error states (e.g. invalid key material, unauthorised notary) are handled gracefully with clear feedback.
  • The feature is covered by appropriate tests.

Desired Output (may vary)

A notary successfully signs a new key binding certificate within eNotary, producing a verifiable artefact that can be used to bind a new key to an identity.

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
     blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

    Skip to content
    eNotary: Notary signs new key binding certificate #970
    Closed
    #972
    Closed
    eNotary: Notary signs new key binding certificate#970
    #972
    Assignees
    coodos
    Labels
    enhancementNew feature or request
    Description
    @plansombl
    plansombl
    bot
    opened on May 23, 2026
    Description
    Inside the eNotary software, a notary must be able to sign a newly generated key binding certificate. This allows a fresh cryptographic key to be officially bound and attested by the notary, establishing trust for downstream consumers of the certificate (e.g. eID wallets, eVault access).
    Reference
    • Related to the eID Wallet passphrase-free recovery flow (see companion issue).
    Acceptance Criteria
    •  The eNotary UI presents a clear workflow for a notary to review and sign a new key binding certificate.
    •  The signed certificate is cryptographically valid and includes the notary's signature over the new public key and binding metadata.
    •  The resulting certificate is exportable / storable in a format consumable by the rest of the MetaState ecosystem.
    •  Signing is gated behind proper notary authentication (the notary must be authenticated before signing).
    •  Error states (e.g. invalid key material, unauthorised notary) are handled gracefully with clear feedback.
    •  The feature is covered by appropriate tests.
    Desired Output (may vary)
    A notary successfully signs a new key binding certificate within eNotary, producing a verifiable artefact that can be used to bind a new key to an identity.
    Metadata
    Metadata
    Assignees
    Labels
    enhancementNew feature or request
    Type
    No type
    Projects
    No projects
      Milestone
      No milestone
      Relationships
      None yet
      Development
      No branches or pull requests
      Issue actions
      
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

      Skip to content
      eNotary: Notary signs new key binding certificate #970
      Closed
      #972
      Closed
      eNotary: Notary signs new key binding certificate#970
      #972
      Assignees
      coodos
      Labels
      enhancementNew feature or request
      Description
      @plansombl
      plansombl
      bot
      opened on May 23, 2026
      Description
      Inside the eNotary software, a notary must be able to sign a newly generated key binding certificate. This allows a fresh cryptographic key to be officially bound and attested by the notary, establishing trust for downstream consumers of the certificate (e.g. eID wallets, eVault access).
      Reference
      • Related to the eID Wallet passphrase-free recovery flow (see companion issue).
      Acceptance Criteria
      •  The eNotary UI presents a clear workflow for a notary to review and sign a new key binding certificate.
      •  The signed certificate is cryptographically valid and includes the notary's signature over the new public key and binding metadata.
      •  The resulting certificate is exportable / storable in a format consumable by the rest of the MetaState ecosystem.
      •  Signing is gated behind proper notary authentication (the notary must be authenticated before signing).
      •  Error states (e.g. invalid key material, unauthorised notary) are handled gracefully with clear feedback.
      •  The feature is covered by appropriate tests.
      Desired Output (may vary)
      A notary successfully signs a new key binding certificate within eNotary, producing a verifiable artefact that can be used to bind a new key to an identity.
      Metadata
      Metadata
      Assignees
      Labels
      enhancementNew feature or request
      Type
      No type
      Projects
      No projects
        Milestone
        No milestone
        Relationships
        None yet
        Development
        No branches or pull requests
        Issue actions
        
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

        Skip to content
        eNotary: Notary signs new key binding certificate #970
        Closed
        #972
        Closed
        eNotary: Notary signs new key binding certificate#970
        #972
        Assignees
        coodos
        Labels
        enhancementNew feature or request
        Description
        @plansombl
        plansombl
        bot
        opened on May 23, 2026
        Description
        Inside the eNotary software, a notary must be able to sign a newly generated key binding certificate. This allows a fresh cryptographic key to be officially bound and attested by the notary, establishing trust for downstream consumers of the certificate (e.g. eID wallets, eVault access).
        Reference
        • Related to the eID Wallet passphrase-free recovery flow (see companion issue).
        Acceptance Criteria
        •  The eNotary UI presents a clear workflow for a notary to review and sign a new key binding certificate.
        •  The signed certificate is cryptographically valid and includes the notary's signature over the new public key and binding metadata.
        •  The resulting certificate is exportable / storable in a format consumable by the rest of the MetaState ecosystem.
        •  Signing is gated behind proper notary authentication (the notary must be authenticated before signing).
        •  Error states (e.g. invalid key material, unauthorised notary) are handled gracefully with clear feedback.
        •  The feature is covered by appropriate tests.
        Desired Output (may vary)
        A notary successfully signs a new key binding certificate within eNotary, producing a verifiable artefact that can be used to bind a new key to an identity.
        Metadata
        Metadata
        Assignees
        Labels
        enhancementNew feature or request
        Type
        No type
        Projects
        No projects
          Milestone
          No milestone
          Relationships
          None yet
          Development
          No branches or pull requests
          Issue actions
          
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

          Skip to content
          eNotary: Notary signs new key binding certificate #970
          Closed
          #972
          Closed
          eNotary: Notary signs new key binding certificate#970
          #972
          Assignees
          coodos
          Labels
          enhancementNew feature or request
          Description
          @plansombl
          plansombl
          bot
          opened on May 23, 2026
          Description
          Inside the eNotary software, a notary must be able to sign a newly generated key binding certificate. This allows a fresh cryptographic key to be officially bound and attested by the notary, establishing trust for downstream consumers of the certificate (e.g. eID wallets, eVault access).
          Reference
          • Related to the eID Wallet passphrase-free recovery flow (see companion issue).
          Acceptance Criteria
          •  The eNotary UI presents a clear workflow for a notary to review and sign a new key binding certificate.
          •  The signed certificate is cryptographically valid and includes the notary's signature over the new public key and binding metadata.
          •  The resulting certificate is exportable / storable in a format consumable by the rest of the MetaState ecosystem.
          •  Signing is gated behind proper notary authentication (the notary must be authenticated before signing).
          •  Error states (e.g. invalid key material, unauthorised notary) are handled gracefully with clear feedback.
          •  The feature is covered by appropriate tests.
          Desired Output (may vary)
          A notary successfully signs a new key binding certificate within eNotary, producing a verifiable artefact that can be used to bind a new key to an identity.
          Metadata
          Metadata
          Assignees
          Labels
          enhancementNew feature or request
          Type
          No type
          Projects
          No projects
            Milestone
            No milestone
            Relationships
            None yet
            Development
            No branches or pull requests
            Issue actions
            
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

            Skip to content
            eNotary: Notary signs new key binding certificate #970
            Closed
            #972
            Closed
            eNotary: Notary signs new key binding certificate#970
            #972
            Assignees
            coodos
            Labels
            enhancementNew feature or request
            Description
            @plansombl
            plansombl
            bot
            opened on May 23, 2026
            Description
            Inside the eNotary software, a notary must be able to sign a newly generated key binding certificate. This allows a fresh cryptographic key to be officially bound and attested by the notary, establishing trust for downstream consumers of the certificate (e.g. eID wallets, eVault access).
            Reference
            • Related to the eID Wallet passphrase-free recovery flow (see companion issue).
            Acceptance Criteria
            •  The eNotary UI presents a clear workflow for a notary to review and sign a new key binding certificate.
            •  The signed certificate is cryptographically valid and includes the notary's signature over the new public key and binding metadata.
            •  The resulting certificate is exportable / storable in a format consumable by the rest of the MetaState ecosystem.
            •  Signing is gated behind proper notary authentication (the notary must be authenticated before signing).
            •  Error states (e.g. invalid key material, unauthorised notary) are handled gracefully with clear feedback.
            •  The feature is covered by appropriate tests.
            Desired Output (may vary)
            A notary successfully signs a new key binding certificate within eNotary, producing a verifiable artefact that can be used to bind a new key to an identity.
            Metadata
            Metadata
            Assignees
            Labels
            enhancementNew feature or request
            Type
            No type
            Projects
            No projects
              Milestone
              No milestone
              Relationships
              None yet
              Development
              No branches or pull requests
              Issue actions
              
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

              Skip to content
              eNotary: Notary signs new key binding certificate #970
              Closed
              #972
              Closed
              eNotary: Notary signs new key binding certificate#970
              #972
              Assignees
              coodos
              Labels
              enhancementNew feature or request
              Description
              @plansombl
              plansombl
              bot
              opened on May 23, 2026
              Description
              Inside the eNotary software, a notary must be able to sign a newly generated key binding certificate. This allows a fresh cryptographic key to be officially bound and attested by the notary, establishing trust for downstream consumers of the certificate (e.g. eID wallets, eVault access).
              Reference
              • Related to the eID Wallet passphrase-free recovery flow (see companion issue).
              Acceptance Criteria
              •  The eNotary UI presents a clear workflow for a notary to review and sign a new key binding certificate.
              •  The signed certificate is cryptographically valid and includes the notary's signature over the new public key and binding metadata.
              •  The resulting certificate is exportable / storable in a format consumable by the rest of the MetaState ecosystem.
              •  Signing is gated behind proper notary authentication (the notary must be authenticated before signing).
              •  Error states (e.g. invalid key material, unauthorised notary) are handled gracefully with clear feedback.
              •  The feature is covered by appropriate tests.
              Desired Output (may vary)
              A notary successfully signs a new key binding certificate within eNotary, producing a verifiable artefact that can be used to bind a new key to an identity.
              Metadata
              Metadata
              Assignees
              Labels
              enhancementNew feature or request
              Type
              No type
              Projects
              No projects
                Milestone
                No milestone
                Relationships
                None yet
                Development
                No branches or pull requests
                Issue actions
                
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

                Skip to content
                eNotary: Notary signs new key binding certificate #970
                Closed
                #972
                Closed
                eNotary: Notary signs new key binding certificate#970
                #972
                Assignees
                coodos
                Labels
                enhancementNew feature or request
                Description
                @plansombl
                plansombl
                bot
                opened on May 23, 2026
                Description
                Inside the eNotary software, a notary must be able to sign a newly generated key binding certificate. This allows a fresh cryptographic key to be officially bound and attested by the notary, establishing trust for downstream consumers of the certificate (e.g. eID wallets, eVault access).
                Reference
                • Related to the eID Wallet passphrase-free recovery flow (see companion issue).
                Acceptance Criteria
                •  The eNotary UI presents a clear workflow for a notary to review and sign a new key binding certificate.
                •  The signed certificate is cryptographically valid and includes the notary's signature over the new public key and binding metadata.
                •  The resulting certificate is exportable / storable in a format consumable by the rest of the MetaState ecosystem.
                •  Signing is gated behind proper notary authentication (the notary must be authenticated before signing).
                •  Error states (e.g. invalid key material, unauthorised notary) are handled gracefully with clear feedback.
                •  The feature is covered by appropriate tests.
                Desired Output (may vary)
                A notary successfully signs a new key binding certificate within eNotary, producing a verifiable artefact that can be used to bind a new key to an identity.
                Metadata
                Metadata
                Assignees
                Labels
                enhancementNew feature or request
                Type
                No type
                Projects
                No projects
                  Milestone
                  No milestone
                  Relationships
                  None yet
                  Development
                  No branches or pull requests
                  Issue actions