The supplier's signature

An organisation that speaks through many people has two problems

Coordination is the one everyone names. Proof is the one that only appears at the worst moment.

• Coordination: two hundred people each say something this week; nobody knows the agreed wording at the moment of typing.
• Proof: someone asserts the organisation said a thing. Now the question is not what to say — it's what can be shown.
• A shared drive answers the first. It answers the second not at all: a modified date is written by the party making the claim.

A record, an integrity check, and an attestation are three different things

Most products stop at the first and describe it as though it were the third.

• Record: a statement that something happened. Rests entirely on trusting whoever holds it.
• Integrity check: have these bytes changed? A hash answers that, and nothing about when or who.
• Attestation: a party who was not the author — a signature, a timestamp. It doesn't make the claim true; it narrows the stories that can be told about it.

Three components, none of them novel

The lack of novelty is the point — each is publicly specified, with implementations nobody here controls.

• Content hash: SHA-256 over canonical bytes. Canonicalisation matters, or a third party cannot reproduce the fingerprint.
• Signature: Ed25519 (RFC 8032, IRTF Informational). Applied at save; an approval that cannot be signed is refused, not stored unsigned.
• Timestamp: RFC 3161 (standards-track). The authority receives a fingerprint and nothing else — it cannot know what it has dated.

The timestamp is the interesting part

A signature made by the party holding the record proves less than it appears to — they control both the record and the clock.

• The authority breaks the circle by being someone else.
• It isn't trusted for being virtuous — it's trusted for having no stake and a checkable signature.
• The same reason a will is witnessed by someone who does not inherit.

Whose signature it is, and where it goes next

What a third party verifies without us is a supplier's signature and — where the outside authority was reachable when the record was saved — a timestamp from a party with no stake in the argument. Together they retire the story that actually gets used: we wrote that last week and back-dated it.

• The timestamp constrains the timing question, because the authority really is outside.
• What it does not retire is collusion: if supplier and organisation ever acted together, the archive is worth what their joint word is worth.
• The step beyond is the organisation holding its own key — governance before engineering: who holds it, under what mandate, what happens when they leave.

Evidence, not a presumption

Under eIDAS Article 41 a qualified timestamp carries a presumption in EU law. These tokens are not qualified, so that presumption does not arise — and what a New Zealand tribunal would make of one is a lawyer’s question, not ours.

• A presumption is a fact a tribunal must accept unless rebutted.
• Evidence is something a tribunal weighs. That is the practical difference.
• This is a description of the instruments, not legal advice — which nobody should take from software.

Who may approve is not a question for the software

Most governance tooling answers it because the answer has to come from somewhere. It does not have to come from the supplier.

• A dispute about wording: settled by the hash.
• A dispute about timing: constrained by a party with no interest in the answer.
• A dispute about authority: not addressed by cryptography, and it should not be. A tool that decided who may approve would be writing a piece of the constitution.

What the demonstration runs

The coordination half is real code working on the visitor's own text. The attestation half is described rather than performed, because the page talks to no database.

• Open without an account, invented organisation, nothing stored.
• The conformance check running on a visitor's own text is the production service.
• Signing itself happens in the product: an approval made inside a party's own Village is signed before it is saved, and downloads as bytes the party can check with ordinary tools.

Where to look

• The essay — agenticgovernance.digital/papers/the-suppliers-signature.html
• Brief, Q&A, glossary, sources — same address
• The demonstration, no account needed — mysovereignty.digital/party-messaging-demo.html

The signing key is ours. What you can check without us is a supplier’s signature, not your own — and closing that gap is a question for your rules, not our software.