What is proven here
In production, PhishGuard mints tokens on a server, keeps the used-token store server-side, and signs with an HMAC key that never reaches the browser. This page runs the whole flow with the store and the key held in the tab, so you can watch every step of it happen.
What runs for real here: a 24-byte token from crypto.getRandomValues, a real HMAC-SHA256 signature, real expiry arithmetic against your system clock, and a real one-shot consumption check against the in-page store. All four outcomes are reachable, and each one is logged with a real timestamp.
The signing key lives in this page by design, so treat the signature as a demonstration of the mechanism rather than as a security boundary: in production that key stays server-side, and that is what makes a signature trustworthy. Anti-fraud, email delivery and risk scoring run on the server for the same reason. The in-page used-token store lasts for this tab and is cleared on reload.