One video. One critique. One signed record.

The browser fetches the sealed record and published keyring, recomputes every declared digest, and verifies the Ed25519 signature locally.