PontIQ — independent verification of this sealed Combo

Use real OpenSSL (not LibreSSL). No PontIQ API verdict is needed.
1) Reproduce the published commitment from the exact files; do not add newlines:
   cat combo.txt nonce.txt > preimage.bin
   openssl dgst -sha256 preimage.bin
   The digest must equal hash.txt. Inspect combo.txt for the complete ordered selections.

2) Read the signed UTC Time stamp from the token, independently of these instructions:
   openssl ts -reply -in timestamp.tsr -text
   Confirm it equals 2026-09-12T11:50:02.000Z (Unix seconds: 1789213802).
3) Verify the imprint/signature and certificate chain AT that signed time, even after certificate expiry:
   openssl ts -verify -data preimage.bin -in timestamp.tsr -CAfile freetsa-ca.pem -attime 1789213802
   The command must print "Verification: OK". The -attime value must equal the token time from step (2).
   Compare its UTC Time stamp with firstKickoffUtc in combo.txt.
   It must be strictly EARLIER than the original scope deadline: 2026-09-12T12:00:00.000Z. Equality is late.
   Use the committed original deadline, even if a current fixture has moved.
FreeTSA is a free, non-qualified RFC-3161 service. Independently check the CA trust anchor.

This evidence does not certify prediction quality, a betting edge or the accuracy of later results.
Later result corrections do not change these original selections or proof bytes.
