Transparency client - allow the use of offline keys for the transparent statement verification

[ivarprudnikov]

Updates to verification

• Allow clients to pass JSON { "domain.name": { "JWKS" } } to enable offline verification of transparent statements, this is to improve potential issues with latency when verifying statements on a scale in Confidential Signing Service
• Allow clients to determine if network fallback is allowed if the public key domain is not to be found in the provided JSON

Contributing to the Azure SDK

Please see our CONTRIBUTING.md if you are not familiar with contributing to this repository or have questions.

For specific information about pull request etiquette and best practices, see this section.

[github-actions]

API Change Check

APIView identified API level changes in this PR and created the following API reviews

Azure.Security.CodeTransparency

[Copilot]

Pull request overview

This PR introduces support for offline verification of transparent statements by allowing clients to provide pre-configured JWKS (JSON Web Key Set) documents mapped by ledger domain. This feature is designed to improve latency and reliability when verifying statements at scale in the Confidential Signing Service.

Key changes:

• Added CodeTransparencyOfflineKeys class to store domain-to-JWKS mappings for offline verification
• Extended CodeTransparencyVerificationOptions with OfflineKeys property and OfflineKeysBehavior enum to control network fallback behavior
• Modified verification logic in CodeTransparencyClient to prioritize offline keys before falling back to network retrieval

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
CodeTransparencyOfflineKeys.cs	New class providing a case-insensitive dictionary to map ledger domains to JWKS documents for offline verification
CodeTransparencyVerificationOptions.cs	Added properties for offline keys configuration and behavior control, plus new enum for fallback behavior
CodeTransparencyClient.cs	Integrated offline key lookup logic with optional network fallback in the verification flow
CodeTransparencyClientUnitTests.cs	Added three new tests covering offline verification scenarios (pure offline, with fallback, and failure without fallback)
Azure.Security.CodeTransparency.netstandard2.0.cs	Updated public API surface to expose new types and properties
Azure.Security.CodeTransparency.net8.0.cs	Updated public API surface to expose new types and properties
CodeTransparencyClientOptions.cs	Minor whitespace formatting improvement

---

You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.