Post-quantum attestations

Verify kind-10203 events before using their advertised post-quantum keys. The package also derives keys from a BIP-39 seed and encrypts hybrid messages.

Example

import { verifyAttestation } from '@nostr-wot/pq';

export function readPublicKeys(event: Parameters<typeof verifyAttestation>[0]) {
  const attestation = verifyAttestation(event);
  if (!attestation.usable) throw new Error('Unusable PQ attestation');
  return attestation;
}

Integration notes

A valid event signature alone is insufficient: check usable before trusting the attestation. Derive keys from the seed, never from an nsec. Hybrid messaging requires explicit support at both ends; never silently downgrade.