The supplier's signature
The hard questions first, because a Q&A that opens with the easy ones is a sales document.
Because the three things in dispute come apart, and the key only weakens one of them.
If someone claims your wording changed, the content hash settles it and the key is irrelevant — the bytes either match the fingerprint or they do not, and anyone can check that.
If someone claims you adopted a position after an event, the timestamp constrains it, and the timestamp authority is genuinely outside both of us. Our key does not enter into it.
What our key does not settle is collusion: if we and you were both lying, the archive is worth what our joint word is worth. The timestamp is the part that holds regardless, because the authority is outside both of us — and the essay takes the question up under its own heading rather than in a footnote.
Technically yes; that is not the hard part. The hard part is that a private key capable of committing an organisation to a position is a constitutional object, not a configuration setting.
Who holds it? Under what mandate? What happens when that person leaves, or is voted out, or falls out with the committee? What does your constitution say about a signature made in your name by someone who has since lost the confidence of the members?
Those questions have answers, but they are yours, and a supplier who supplies the key before you have answered them has quietly written a piece of your governance. We would rather say the limit out loud than paper it over.
No, and be careful of anyone who says otherwise.
Under eIDAS Article 41, a qualified electronic time stamp carries a presumption of accuracy in EU law — a tribunal must accept it unless it is rebutted. The tokens described here come from an ordinary authority and are not qualified, so that presumption does not arise even within the Union. eIDAS is EU law, and what weight a New Zealand tribunal would give such a token is a question for a lawyer there.
So: evidence a tribunal may weigh, not a fact it must accept. That is a description of the instruments and not legal advice, which you should not take from software or from whoever wrote it.
For the timestamp, the authority — it signs the moment, not us, and it has no stake in your dispute.
For the signature, the design decision that an approval which cannot be signed is refused rather than stored unsigned. That matters more than it sounds. An unsigned record looks identical to a signed one on every screen, and it could never be signed later without lying about when. So the system fails closed: no record, rather than a record we could quietly attest to afterwards.
No. It receives a fingerprint — a fixed-length number — and nothing else. Not the copy, not the policy, not anyone’s name. It cannot know what it has dated, which is the point.
You do, under your own rules, and the software declines to have a view.
This is the answer we are most often asked to change, and the one we are least willing to. Most governance tooling answers the authority question because the answer has to come from somewhere. It does not have to come from us. It can be a field you fill in from rules you already have.
No — that is not what it is for. A member’s words go through as they wrote them, and a flag is a note to the author rather than a veto.
There is exactly one thing it blocks: copy citing a policy the organisation has withdrawn. The reasoning is that a member cannot reasonably be expected to know a policy was retired last week. If the policy comes back, the copy returns to the status it previously held — recorded as a restoration, never as a fresh approval.
It reads the draft against the organisation’s own code of conduct, names the clause the wording touches, quotes that clause back, and says which phrase set it off. It also names the clauses it has no pattern for — so a clean result is not mistaken for a clearance.
It does not block and it does not rewrite. It tells the author what a reviewer is going to see before they send it to one.
Yes — mysovereignty.digital/party-messaging-demo.html, no account needed. The organisation in it is invented and nothing you type is stored.
What runs there is the coordination half: real code working on your text. The attestation half is described rather than performed, because the page talks to no database, and a page that signs nothing cannot demonstrate signing. Signing happens in the product itself: an approval made inside a party’s own Village is signed before it is saved, and the party can download that approval as a folder of bytes and check it with openssl and ordinary shell tools.