From 422b790dc9d8e7ac73a0565369bf4ba1d6368f96 Mon Sep 17 00:00:00 2001
From: Bishop Bettini <bishop.bettini@gmail.com>
Date: Sat, 8 Aug 2026 09:55:21 -0400
Subject: [PATCH] feat:improve verify text

---
 pages/index/page.css  | 28 ++++++++++++++++++++++++++++
 pages/index/page.html |  9 ++++++---
 2 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/pages/index/page.css b/pages/index/page.css
index 4106d21..3f9d552 100644
--- a/pages/index/page.css
+++ b/pages/index/page.css
@@ -139,3 +139,31 @@ a:hover {
   margin-bottom: 2rem;
   text-align: left;
 }
+
+.trust summary {
+  cursor: pointer;
+}
+
+.trust summary::marker {
+  color: var(--accent);
+}
+
+.trust summary:hover {
+  text-decoration: underline;
+}
+
+.trust details p {
+  margin-top: 0.6rem;
+}
+
+.trust pre {
+  margin: 0.6rem 0;
+  padding: 0.6rem 0.75rem;
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: 0.375rem;
+  overflow-x: auto;
+  font-size: 0.8rem;
+  white-space: pre-wrap;
+  word-break: break-all;
+}
diff --git a/pages/index/page.html b/pages/index/page.html
index 620efa2..3886535 100644
--- a/pages/index/page.html
+++ b/pages/index/page.html
@@ -22,9 +22,12 @@ <h1>Your passwords.<br>Your storage.<br>Your browser.</h1>
     </div>
 
     <div class="trust">
-      <strong>This file is identical to what is served at keepass-web.app.</strong>
-      Every file on the hosted site is a verbatim copy of a published release artifact.
-      Download the release, verify the published checksum, and trust what you audit.
+      <details>
+        <summary><strong>Verify before you trust.</strong> Tampering would leave a public, permanent trace.</summary>
+        <p>Every release is cryptographically attested and logged to a public transparency log (Sigstore). Verify any downloaded file was built by this project's Release workflow, not hand-assembled:</p>
+        <pre><code>gh attestation verify &lt;file&gt; --repo keepass-web/source-application</code></pre>
+        <p>Requires the <a href="https://cli.github.com/">GitHub CLI</a>. Prefer to build it yourself from source instead? See <a href="https://github.com/keepass-web/source-application/blob/main/docs/REPRODUCING.md">Reproducing a Build</a>.</p>
+      </details>
     </div>
   </main>
   <!--FOOTER-->