This host publishes the public keys used to sign clinic archives, so that an archive can be verified by whoever holds it — without needing anything from the platform that produced it.
The directory is at
/.well-known/dental-archive-keys.json.
It contains public keys and their revocation state. Nothing else: no patient data, no clinic
data, no credentials.
It is append-only. A key is never removed, because archives signed under it must keep verifying after it is retired. A key that should no longer be trusted is marked revoked rather than deleted.
The private halves are held in Google Cloud KMS and cannot be exported, including by the people who run this service.