How CognisecX credential verification works

## Three layers of trust

1. The PDF carries a SHA-256 hash of its bytes; tampering breaks the hash.
2. The verify page is served from cognisecx.com over TLS and is server-rendered    so it works without JavaScript — even if our SPA is broken.
3. A daily Merkle batch anchors every issued credential's hash on a public chain.    Once anchored, even CognisecX going offline doesn't break verification.

## Why no JS on /verify/<id>/

Employers shouldn't have to trust our build pipeline. The page is plain HTML served by Django; the only dynamic data is the credential row. If your AdBlocker or CSP misbehaves, the page still works.