consenthub-verify: check a ConsentHub receipt offline
=====================================================

What you need
  * Node.js 18 or newer (https://nodejs.org, the LTS build). Nothing else: no install step, no network.
  * The receipt, saved from its page with "Download receipt (JSON)".
  * The public key the receipt names, saved from the verification page or the receipt page ("Download the public key").

Windows (Command Prompt or PowerShell, inside this folder)
  .\consenthub-verify.cmd --receipt receipt.json --pubkey consenthub-public.pem

Linux / macOS (inside this folder)
  ./consenthub-verify --receipt receipt.json --pubkey consenthub-public.pem

If the launcher is not executable on Linux, run it through Node directly:
  node bin/consenthub-verify.mjs --receipt receipt.json --pubkey consenthub-public.pem

What you should see
  receipt rcp_... - VERIFIED
    payload hash   : matches
    signature      : valid
  Exit code 0 means verified; 1 means the receipt or signature does not match; 2 means a file or argument was wrong.
  Change one character of the receipt and run it again: it must fail.

Several keys
  A receipt names the key that signed it (its "kid"). Put every key you hold in one folder as <kid>.pub.pem and run with
  --keyring <folder> instead of --pubkey; the right key is chosen by name, so a receipt signed before a key rotation still
  verifies.

Other options
  --json    machine-readable output        --quiet   no output, exit code only        --chain export.json   a ledger export
