Reproduce it with Node.
The bundle is the offline verifier, the published signed projection, the pinned public key, and a README. Unpack it and run the command below. Node does the check. Nothing is installed and nothing is fetched.
Or take the pieces separately: verify.mjs, signed projection, pinned public key, README.
Copy-paste
From the unpacked directory:
node verify.mjs signed-projection-2026-09-11.json
The verifier is a single file you can read before you run it: open verify.mjs.