docs(tutorial): the verifier checks signatures, and needs no clone

[imran-siddique]

Two corrections to docs/tutorials/anchoring-to-the-registry.md, both found by running the tool the page tells the reader to install.

The one that matters

The page said:

It does not validate the signature or establish that the record's contents are true. Signature verification against a trusted producer key is a separate step (spec §3.3).

trace-verify has verified the producer's Ed25519 signature by default for as long as the signature extra has existed, and refuses rather than skipping when it cannot. A reader following this page was told exit 0 meant less than it does, which is the direction of error that matters: it invites treating an unverified record as checked, or repeating a check that already ran.

Exit 0 now says what it covers, both halves, and --no-verify-signature is named as the way to get inclusion alone, with the reason it warns.

No clone needed

The page showed --entry registry/2026/06/12.ndjson, a local path, with no mention that the registry need not be cloned. As of trace-verify 0.4.1, --entry-url fetches both the entry and the producer key that signed the record, from an allowlisted host, and reports which key it used and where it came from. The tutorial now shows that invocation and names the minimum version.

One addition

The "what this does not prove" section correctly says inclusion does not establish an append-only history. That question has had an answer since trace-verify 0.4.0, so the section now points at it:

trace-verify chain registry/2026/09/01.ndjson

No normative text changes. Tutorial only.

🤖 Generated with Claude Code

https://claude.ai/code/session_01X2GDChXjA7BAdDNzCAmBJv