This demonstration is protected by the very layer it explains. Three real factors — a hardware key, a Verity-anchored grant, and a passphrase — must all pass. The content is encrypted at rest; the verify plane is your front door.
1
Possession — hardware passkey
Secure Enclave / TPM / security key signs a challenge
2
Authority — Verity-anchored grant
viewer credential chain-verifies to a Verity root
3
Knowledge — access passphrase
derives the key the demo is encrypted with
present your device key to begin
RUNG: hardware-real · WebAuthn passkey + real Ed25519 grant chain-verify + AES-GCM content.
Enforcement = encryption-at-rest. Server-gated + live-revocation + production-root anchoring
(gated on Verity R1) = verifier-real / production-real (see SECURE_DEMO_GATE.md).