Verifiable signature proof without trusting the provider
How can an electronic signature be verified without depending on the provider? Explanations on the Ed25519-signed proof file, PAdES sealing, and RFC 3161 timestamping.
A verifiable signature proof without trusting the provider
When a company adopts an electronic signature service, it relies on the provider to retain the evidence. In the event of a dispute, it often has to ask the provider to supply an export or an attestation. This dependency is not always satisfactory: what happens if the provider ceases operations or if its servers are compromised?
An alternative exists: a cryptographically signed proof file, whose public key is published, allows anyone to verify the authenticity of documents, without having to trust the provider. This is what Sign-Hub offers.
What is a verifiable signature proof?
An electronic signature aims to guarantee the integrity of the document and the signatory's consent. But for this signature to be legally valid, it must be possible to verify it later. Conventional solutions provide a signed PDF file and an internal audit log. However, this log is stored at the provider: it is not directly verifiable by a third party.
A verifiable proof is a set of data (hashes, timestamps, identifiers) that can be checked independently, using a public key. Thus, a judge, an expert, or a client can ensure that the document has not been modified and that the signature did indeed take place on a given date.
The Ed25519-signed proof file: an innovation by Sign-Hub
Sign-Hub stands out by publishing an Ed25519 public key at a dedicated URL: https://sign-hub.newvisionofapps.fr/.well-known/sign-hub-keys.json. This key is used to sign each proof file, called proof.json. This file contains the signature metadata: date, time, IP address (anonymized), document identifier, etc.
Thanks to this public key, anyone can verify a proof.json offline, with standard tools, or online at https://sign-hub.newvisionofapps.fr/verify. This approach is rare: most players, such as Yousign or DocuSign, do not provide a verifiable public key for their logs. They settle for a PDF export and an internal log, not verifiable by a third party.
How does verification work?
- The client application receives an HMAC-signed webhook after each signature.
- It downloads the signed PDF and the proof file
proof.json. - It can then verify the signature of the file with the published public key.
- It can also verify the PDF, which is sealed in PAdES format.
This verification requires no connection to the Sign-Hub server: it can be done at any time, even if the service no longer exists. This is a guarantee of durability for your evidence.
PAdES sealing: enhanced protection for the PDF
The PDF signed by Sign-Hub is sealed in PAdES format (PDF Advanced Electronic Signatures). This is a European standard that defines how to embed an electronic signature in a PDF securely. PAdES sealing guarantees that any subsequent modification of the document will invalidate the signature.
Concretely, the PDF contains a digital signature based on a certificate. This signature covers the entire document, including the metadata. Thus, if someone attempts to modify the content, the signature becomes invalid.
RFC 3161 timestamping: a reliable date
To prove that a signature was affixed at a precise moment, Sign-Hub optionally offers RFC 3161 timestamping. This standard makes it possible to obtain a timestamp token from a trusted third-party authority. This token is linked to the document's hash at a given instant, and it is itself signed by this authority.
Thus, even if your computer or the Sign-Hub server had an incorrect date, the timestamp is authoritative. This is an important element in the event of a dispute over the signature date.
Comparison with other players
- Yousign: offers an advanced electronic signature, with a qualified certificate for certain offerings. However, the proof provided is mainly a PDF and an audit log accessible on their platform. No public key published for independent verification.
- DocuSign: global leader, offers complete audit logs, but verification relies on trust in DocuSign. No open proof mechanism like Ed25519.
- Universign: specialist in qualified signatures, relies on recognized certificates. Their proof is robust, but it depends on the certification authority.
Sign-Hub positions itself differently: it does not claim to provide an advanced or qualified signature, but it offers a technical proof verifiable by all. This transparency is an asset for companies that want to control their evidence.
Limitations to be aware of
Sign-Hub provides an electronic signature that is simple within the meaning of the eIDAS regulation, reinforced by email verification and PAdES sealing. It is neither advanced nor qualified. For certain uses (notarial deeds, public procurement), a qualified signature may be required. In that case, one must turn to players such as Universign.
Moreover, the service is offered in mainland France and the DROM only. Data is hosted in the European Union, which complies with the RGPD.
Why does this change the game for developers?
For a developer, integrating an electronic signature often means trusting a black box. With Sign-Hub, the API is documented (OpenAPI 3.1), a TypeScript SDK is provided, and an llms.txt file is designed to be read by a coding assistant. But above all, proof verification can be automated: a script can verify the proof.json and the signed PDF without human intervention.
Conclusion: proof that belongs to you
Electronic signature is not just a click. It must leave a reliable and verifiable trace. Sign-Hub allows you to retain proof independent of the provider, thanks to the Ed25519 signature and the PAdES format. You do not have to take Sign-Hub's word for it: you can verify for yourself, at any time.
Try the verification yourself
Go to the verification demonstration page: https://sign-hub.newvisionofapps.fr/verify. You will be able to download a sample proof.json and verify it with the published public key. Or, if you are a developer, use the TypeScript SDK to integrate this verification into your own application. The Découverte plan is free for 10 acts per month, with no commitment. Test and judge for yourself.