Verify a C2PA seal.

Drop a sealed PDF or a .c2pa manifest. Authmarks runs the full offline check: the cryptographic signature, the Authmarks trust chain and the content binding. The file is read in memory and never stored.

1. Signature. The C2PA manifest carries an ES256 signature over the sealed content. The signer re-computes the signed digest and verifies it against the certificate that was used — a cryptographic check, no Authmarks service in the loop.
2. Trust chain. The signing certificate must chain to the Authmarks root. A well-formed signature from any other certificate authority validates as valid, not trusted — honestly disclosed. The Authmarks root certificate is public.
3. Content binding. For a sealed PDF, the manifest commits to a hash of the PDF bytes; the verifier recomputes the hash from your upload and compares. One altered character and the binding breaks. (A detached .c2pa file has no asset to bind to on its own; upload the sealed PDF for the full check.)

When the manifest carries an Authmarks record_id and we recognise the seal, the result links through to the public certificate page. The full process record remains private to whoever the owner authorises.