Sectigo Quantum Ready development release verification

Use a reviewed copy of scanner/verify_release.py and an independently trusted
release-key.json from your administrator. Do not execute a verifier extracted
from an unverified archive. A key downloaded beside an archive is a reference,
not an independent trust source.

Download these three artifacts without opening or extracting the archive:
  sectigo-quantum-ready-bundle.zip
  manifest.json
  manifest.sig

From your reviewed verifier checkout, run:
  python scanner/verify_release.py --manifest manifest.json --signature manifest.sig --archive sectigo-quantum-ready-bundle.zip --trusted-key /path/to/trusted-release-key.json --expected-version 0.14.0

Use the expected version communicated through your trusted release process.
Optionally add --minimum-sequence N from your trusted release record.
Successful verification prints verified=true with the version, key ID,
sequence and expiration. Only then review/extract/install the bundle.
Verification never extracts files, installs dependencies or executes updates.

Initial development key ID (SHA-256 of raw Ed25519 public key):
057ea0f9faf27f6710f042be3286d595951b5beb1f959e1a9ca5ba0daed9b832

Ed25519 is a classical signature, not a post-quantum signature. This development
release key is not evidence of corporate signing-key authorization, secure
build provenance, malware freedom or production admission. Automated updates,
key rotation/revocation, enterprise key custody and TUF integration are pending.