List the published fiscal verification keys

Returns the Ed25519 PUBLIC keys the NF525 fiscal signature chain is sealed with, so an auditor can verify that chain OFFLINE with no secret: take a record’s key id, fetch the matching publicKeyPem here, recompute the link’s canonical body and check the signature. Unauthenticated on purpose — a public key is not a secret, and publishing it is what makes the signature meaningful.

This is a NARROW, auditor-facing read, not a fiscal reporting endpoint: it carries no sales, totals or journal entries. For the Z/X reports, the fiscal journal and the server-side chain verification, use the pos.finance.view-gated /v1/fiscal/* operations instead. Reach for this only when you are verifying signatures yourself and need the key material.

An EMPTY keys array is a normal, successful answer, not a fault: it means the deployment is signing with symmetric HMAC keys, which have no public half to publish. In that case offline verification is simply not available and there is nothing to retry. keyId is the join key — it matches the #<keyId> suffix stamped on every record the key sealed, and a rotated deployment lists several keys at once so an old record still resolves to the key that signed it. The response never contains private material.