What a signature carries with it

A signature is only worth what you can show about it later. Here is exactly what is recorded and what the public verifier will and will not reveal.

Recorded per document

No disclosure on lookup

> event open=time, address sign=time, address decline=time, reason > seal algorithm=sha256 scope=final rendered file > verify input=content hash returns=title, signers, completion time > verify emails=never returned enumeration=not possible

The verifier accepts a hash and nothing else. A wrong hash returns not found rather than a near match, so the endpoint cannot be walked to discover documents.

Holding a signed document? Check it against its hash on the public verifier, no account needed.