The key directory, in public.
Every public key we hand out for a Thelemail address is written into an append-only log. This page is that log's identity: the values our apps pin, what the log says right now, and the parts that are not finished yet.
What the log says right now.
Read the current state directly from the live log.
What our clients pin.
These values are compiled into the public web client and the private mobile client codebase. A proof only counts if it verifies against them, so changing them requires shipping a new build.
Log identity
- Origin
- thelemail.com/keys
- Checkpoint
- https://tlog.thelemail.com/checkpoint
The log's name inside every checkpoint. It reads like a URL but it is an identifier, and it does not change when the log moves.
Where the log publishes its current tree. Open to anyone.
Pinned keys
- Log verifier key
- thelemail.com/keys+76ead63c+ASduViYkPgYHzuTuDnuTdEkjR/DIprnavuFA3vom4YZT
- VRF public key
- AFye6B/Tm9oZVs25OmoSyDWn16PFdnIhG2vpOJGSzEE=
Signs every checkpoint. Without the matching private key nobody can publish a tree our clients will accept.
Addresses are not written into the log in the clear. Each entry is filed under a verifiable pseudo-random value, so the log is not a readable list of our users, and anyone holding the proof for one address can still check it.
Policy
- Witness threshold
- 2
- Cosignature freshness
- 24 hours
How many independent co-signatures a checkpoint needs to count.
How old a witness cosignature may be before it stops counting toward the threshold.
Cosigned by staging witnesses.
The Witness Network accepted this log on 1 September 2026, and Geomys, Mullvad and TrustFabric consume that staging list. The live checkpoint carries the cosignatures listed below, as read by your browser. This page lists them without verifying them. The browser and macOS desktop clients pin a threshold of two of the three witnesses and verify each cosignature against its pinned key. Runtime enforcement is not active yet: the clients run in monitor mode, so a checkpoint below the threshold is recorded and does not stop a message.
Enrollment is recorded in the Witness Network 10qps staging list. The browser and macOS desktop clients pin two of these three witnesses. Mobile and runtime enforcement follow in their own rollouts.
Do not take this page's word for it.
These go straight to the log. The server answering them is open source.
Read the current checkpoint
The log's signed statement of its size and root hash.
curl https://tlog.thelemail.com/checkpoint
Confirm it is signed by the key above
The checkpoint is a signed note in the c2sp.org/tlog-checkpoint format. Verify it against the log verifier key above.
Look up an address you control
Returns the VRF proof for that address and every statement ever logged for it, so you can see whether a key you were never told about was published under your name.
curl "https://tlog.thelemail.com/monitor?label=YOUR_ADDRESS"
Pull an inclusion proof
A c2sp.org/tlog-proof bundle for one entry, checkable offline against the keys above.
curl "https://tlog.thelemail.com/proof?index=0"
Or run the whole thing
Clone it, read it, run your own copy against the same tiles.
git clone https://github.com/thelemail/keylog.git
Every change to this log.
Key rotations and incidents belong on a page like this whether or not there are any. So far there are none of either.
Log created
The checkpoint key and the VRF key were generated and the first key-directory entries were written under the origin thelemail.com/keys. Neither key has been rotated since.
Log moved to its own service
The log server was split out of the mail backend, published as open source, and moved from a path on the API host to tlog.thelemail.com. The log itself was carried over unchanged: same origin, same keys, same entries, same tree.
Accepted into the staging Witness Network
The log was added to the 10qps staging list with an allowance of 8,640 add-checkpoint requests per day: one every 10 seconds. Geomys, Mullvad and TrustFabric consume this list. The web client was the first app configured with the two-of-three witness policy; the mobile rollout and runtime enforcement follow separately.
Witness cosignatures confirmed on the live checkpoint
An independent review by Markovian Protocol found that checkpoint 233 carried cosignatures from Geomys and Mullvad that verified against the pinned witness keys. Clients still run in monitor mode, so a missing cosignature does not stop a message.
No key rotations
The checkpoint key and the VRF key are the originals. If either is ever rotated it will be recorded here, with the date and the reason, and clients will need an update to accept the new one.
No incidents
No split view, no failed proof we could not account for, no loss of log data. If that changes it will be written here, including the parts that reflect badly on us.
Found something wrong? A proof that will not verify, a key you did not ask for, or a checkpoint that disagrees with one you saved earlier is worth telling us about at [email protected]. Evidence beats a report, and a saved checkpoint is evidence.
Fay ce que vouldras. The only rule of the Abbey of Thélème. Rabelais, Gargantua, 1534.
We wrote down what we can't protect.
The threat model spells out what is encrypted, what is not, and what a server compromise would and would not expose. The gaps we haven't closed yet are listed with it.