What a signed evidence record proves, and what it doesn’t

When evidence leaves your team, for an auditor, a regulator or a board, the first question is whether anyone changed it on the way. A digital signature answers that question, and only that one. Knowing where its answer stops is what keeps signed evidence useful.

What a signature does

Signing a record works in two steps. First, a fingerprint of the content is calculated, a short value that changes completely if a single character of the record changes. Then that fingerprint is signed with a private key that only the signer holds.

Anyone with the matching public key can check the result. If the content has been altered, the fingerprint won’t match and the check fails. If it passes, two things are true: the content is exactly what was signed, and it was signed by the holder of that private key.

Why signed files get over-trusted

A signed file can look like a certificate of good health. Readers assume that because it’s signed, it must be complete and correct, and neither follows. A signature protects whatever was put into the record, including its mistakes and its omissions.

The assumption is understandable, because in everyday life a signature often stands for approval. In cryptography it stands for integrity and origin. Treating it as approval is how an incomplete record ends up carrying more weight than it should.

What a signature does and doesn’t prove

A signature shows that the contents haven’t changed since signing and that the expected signer signed them. It doesn’t show that the record is complete, that every result in it is right, or that your organization is compliant. Those questions need the evidence inside the record, read by someone who understands it.

What to check before you rely on it

Before relying on a signed record, check a few things beyond the signature itself:

• Scope: which systems, environments and sources the record covers, and which it doesn’t.
• Timing: when the facts were observed, not just when the file was signed.
• Declared gaps: what couldn’t be checked, stated in the record itself.
• The signer’s key: whose key it is, and whether you have reason to trust it.

Evidence that states its own limits deserves more trust than evidence that claims to be complete. A record that says “these three hosts weren’t reached” is telling you the truth about everything else.

Signatures over records that must last

Evidence kept for years raises one more question: will the signature method stay trustworthy for as long as the record matters? Signature methods that quantum computers threaten will need replacing on long-lived records too, a problem covered in signatures trusted today, forged later.

A worked example

Illustrative: an auditor receives a signed record of the cryptography used by a payments platform. The signature checks out, so the auditor knows the file is exactly what the security team produced. Inside, the record lists every service it covers, the date each fact was observed, and a short section saying that two batch-processing hosts were offline during collection.

That last section is what makes the record useful. The auditor can rely on everything else and ask a precise follow-up about the two hosts. Without it, the signature would have lent its weight to an incomplete picture, and the gap would have surfaced later, under less friendly circumstances.

For technical teams

A few practical points decide whether signed evidence holds up:

• Protect the signing key as carefully as any other private key, ideally in hardware, with clear rules on who can use it.
• Record the time of observation inside the record, separate from the signing time, so readers know how current the facts are.
• Publish or share the verifying public key through a trusted channel, so a reader can confirm who signed.
• Keep earlier signed versions, so changes over time can be shown, not just the latest state.

Where Arcrix™ helps

Each Arcrix™ result, from Arcrix™ by QTrino Labs, comes with a signed evidence package: what was found, the checks behind it, where each fact came from, and what couldn’t be seen. The gaps travel with the record, so the reader knows what it covers before relying on it.