Executive Summary

Signal’s Automatic Key Verification (AKV) uses key transparency to prevent compromised servers from delivering false public keys. Trail of Bits operates one of three independent auditors that maintain a Merkle‑tree log of key mappings, sign its head, and verify that all clients see a consistent, globally valid key set. The auditor updates its local copy whenever a new key is added, signs the tree head, and clients require signatures from all three auditors within the last seven days. If any auditor’s signature is missing or invalid, AKV fails and the user is warned. This independent implementation ensures that AKV remains trustworthy without requiring direct safety‑number comparison.

---

Intelligence Metadata - Source Publisher: Trail of Bits - Published Date: 2026-08-11T17:30:00+00:00 - Category: research

"We are all inclined to judge ourselves by our ideals; others, by their acts."

— Harold Nicolson