Check a domain's AEO record (v=AEO1) — /.well-known/aeo.json first, then the _aeo DNS TXT record via DNS-over-HTTPS — and independently verify its Ed25519 sig= against the catalog's published facts. The open checker for the AEO record standard (aeorecord.
npm install aeo-record@0.4.0