Engineering
Workers, D1, and keys that never upload
The public loop runs on Cloudflare Workers + D1: create (signed POST), scan resolver, manifesto update, revoke, vouch, live-control challenge. Pages hosts the static UI; private keys are generated and stored in the browser only.
We test the Worker with Vitest (crypto, revoke, scan, CORS). The site is plain HTML + small ES modules - no SPA - so workshop pages stay fast on phone Safari.