List the zh_por_pub Ed25519 public keys used to sign Merkle Sum Tree root commitments, with the range of snapshot dates each one covers.

The list is a discovery convenience, not a trust anchor: it is served over your authenticated partner session but is not itself signed. Pin the key fingerprint you are given out-of-band at onboarding and compare against it.

Keys are region-global rather than platform-scoped, so this endpoint returns the same list for every partner in a region. Unlike the root and proof endpoints it is not gated on Proof of Reserves being enabled for your platform, though the same authentication and device checks still apply.

To verify a commitment, select the entry whose keyId equals the commitment's signingKeyId and check signature against that entry's publicKey.

The validity window is not checkable yet. The only date a root commitment carries is snapshotTs, which is currently emitted as the Unix epoch, so there is nothing meaningful to compare against validFromSnapshotDate..validToSnapshotDate. Do not gate verification on that comparison in this release, and do not substitute your own clock for the missing value.