Note

What a signed file actually costs

A walk through the work of publishing tier B, step by step, with the hard part named.

9 November 2026

The export already exists in some form. Licence reference, status, trade, held-by name, last changed. Pointing it at a file instead of a report is a change to a query and a destination.

The key is generated once. Any wallet or command line tool makes one, it signs the manifest and it never touches anything else. Rotating it later is a DNS change, not a migration.

The DNS record is one line at the authority domain, the same shape as the SPF and DKIM records already sitting in that zone. Nobody has to be told about it, and no registration exists anywhere.

The manifest is a dozen lines of JSON saying what the file covers, how often it changes and the digest of the current version. The scheduling is a cron job writing to the same address.

The hard part is none of these. It is the internal decision that publishing a list already available one licence at a time is allowed in bulk. That is a policy question, not an engineering one, and pretending otherwise wastes the time of the person being asked.

Read this page as Markdown