Verify one ICP query result with a hash-tree witness
A client can verify a single published value without fetching every leaf of a canister's data tree. It must bind that value to the requested key and canister.
Reconstruct the selected leaf
Suppose a quote service returns 42 for /prices/ABC. Decode the witness according to the service's tree layout and value encoding. Recompute the root using the returned bytes, then check it against the certified_data entry for the actual canister ID in a verified subnet certificate.
key = /prices/ABC
value = 42
witness + value → reconstructed root → certified_data
Check freshness separately
Reject a witness for another symbol even if its root is certified. Check the certificate time against a freshness policy, and inspect the quote's own timestamp if business logic needs a recent price. A recently certified root may still contain an old observation.