AUTHENTICITY IS A CHAIN, NOT A NAME.

Round I is signed with Ed25519 over the exact manifest bytes. The manifest also commits to the public key for the next round before that key is revealed.

openssl pkeyutl -verify -pubin -inkey root_ed25519.pem -rawin \
  -in round1.manifest.json -sigfile round1.manifest.sig