Also called: EdDSA
In plain words
Ed25519 is a public-key signature algorithm. The holder of a private key produces a signature over a message, and anyone with the matching public key can check that the signature is valid and that the message hasn't changed by even one bit. It's standardised in RFC 8032, uses 32-byte public keys and 64-byte signatures, is deterministic (the same key and message always give the same signature), and is fast enough to check millions of times.
How QED Proof uses it
Every receipt is signed with pure Ed25519 over a domain-separated message:
message = "POAW-RECEIPT-V0" || 0x0A || JCS(body)
signature = Ed25519-Sign(issuer_private_key, message)
The POAW-RECEIPT-V0 prefix means a receipt signature can never be replayed as a signature over some other kind of data. The body is canonicalised with JCS first, so every implementation signs exactly the same bytes.
The signing key lives in a cloud KMS and can't be exported. Keys are identified by key_id = "ed25519:" + base64url(SHA-256(public key)). The public keys are published at https://api.qedproof.site/.well-known/poaw-keys.json, with validity windows and revocation times.
Example
A signature proves the issuer stated this and nobody altered it since. That's trust level 1. On its own it can't prove the issuer didn't quietly issue a different receipt or backdate one, which is what the log and the anchor add.