DS08 — Signature Plate and Hash Anchoring

Trigger S4, Continuation

The positioned graphic (DS07) shows the drawing — it does not prove it. The proof comes from the signature plate: the visible cryptogram that binds certificate, hash and timestamp to the PDF. E1 asks: How is the graphic cryptographically attached to the document — and how does this remain verifiable natively in the repo?

Anatomy of the Signature Plate

A signature plate (Signature Plate, DocuSign-style) is a visible field in the PDF next to the graphic:

┌──────────────────────────────────────────────┐
│ ____________________________DS                │
│ [Facsimile-Grafik, height=40]                 │
│ Erich Mustermann                    │
│ Geschäftsführer, handelnd für …               │
│ ─────────────────────────────────────────────│
│ ▒ SIGNATURPLATTE (PAdES)                      │
│ Zertifikat: CN=Erich Mustermann (E1)       │
│   SHA-1-Fingerprint: a1b2c3… (angezeigt)      │
│   Aussteller: …                               │
│   Gültigkeit: 2026-09-13 … 2028-09-13         │
│ Dokument-Hash (SHA-256): 3f9a…e21b            │
│ Zeitstempel (TSA): 2026-09-13T15:20:00Z       │
│ Signatur-Format: PAdES-B-T                    │
└──────────────────────────────────────────────┘

The Three Anchors

1. Document Hash (Integrity)

The cryptographic signature (PAdES) binds to the SHA-256 of the PDF document content (byte-range hash). Subsequent changes to the PDF invalidate the signature — eIDAS criterion (b) fulfilled.

2. Certificate (Origin Attribution)

The signature certificate binds the signature key to an identity (CN, organizational unit, qualified where applicable). eIDAS criterion (a) fulfilled. The certificate is displayed (fingerprint, issuer) — a reviewer can look up the identity without crypto tools.

3. Timestamp (Temporality)

A TSA timestamp (Trust Service Provider) binds the time of signing to an independent time source — important for Long-Term-Validation (LTV). uuidV7 timestamps in the signature doc (Part I) remain the repo-native time evidence; the TSA is the formal one.

The Hash Chain: Source Document → Signature Doc → PDF

The core of the docking is an anchored hash chain across all levels:

%%{init: {'theme':'base','themeVariables':{'primaryColor':'#FBFAF7','primaryTextColor':'#0F1B33','primaryBorderColor':'#6B7280','lineColor':'#6B7280'}}}%% flowchart LR A["Quell-Dokument (MD)
sha256 T"] --> B["Signatur-Doc
target.sha256 = T"] B --> C["[FES](../../glossar.html#fes "Fortgeschrittene elektronische Signatur — Glossar")-Dienst
rendert PDF aus Quell-Dokument"] C --> D["PDF (PAdES)
Byte-Range-Hash P"] D --> E["Signaturplatte
zeigt P + Zertifikat + TSA"] B --> F["Envelope-Report (DS09)
sha256(P) = verifiziert"]

Verification (repo-native):

# 1. Quell-Dokument unverändert?
sha256sum source.md                          # = T
# 2. PDF-Hash stimmt mit Envelope-Report?
sha256sum fes-output.pdf                     # = P (im Report)
# 3. PDF-Signatur kryptographisch intakt? (externes Tool)
pdfsig fes-output.pdf                        # VALID, PAdES-B-T

Signature Format: PAdES

Format	Carrier	GitCover Usage
PAdES	PDF	Standard for FES procedures with Facsimile layer (Part II)
XAdES	XML	Not typical in the repo context
CAdES	generic	FES services with their own envelope structure

PAdES levels (relevant for the saga):

B-B/B-T: Basic + timestamp — typical DocuSign output level
B-LT: Long-Term-Validation (revocation data embedded)
B-LTA: Archiving level (regenerable over 10 years — GoBD relevance)

Facsimile and Crypto Binding: The Division of Roles

Level	Carrier	Evidentiary Function
Visible graphic (Facsimile)	SVG/PNG in the layer	Identification (§ 126b (3), § 371a ZPO: affixing of the name)
Cryptographic signature	PAdES byte-range hash	Integrity (eIDAS (b), (d))
Certificate	Signature plate	Origin attribution (eIDAS (a))
TSA timestamp	Signature plate	Temporality (eIDAS LTV)
Repo chain	Signature doc + events	Procedural documentation, verification routine (DS04)

No single element carries it alone — the combination of graphic, crypto and repo chain is the evidentiary value. That is the saga's core message: GitCover does not replace DocuSign, but anchors it.

Verification Manifest

The GCPN container (DS05) receives a verification manifest that bundles all hashes:

{
  "verification": {
    "ur_doc_sha256": "T",
    "signature_doc_sha256": "…",
    "events_sha256": ["…", "…"],
    "facsimile_sha256": "8fcffe0b…1006",
    "facsimile_guid": "01a09b48-4580-76f9-b789-024691b989c5",
    "pdf_sha256": "P",
    "pdf_signature_format": "PAdES-B-T",
    "tsa_timestamp": "2026-09-13T15:20:00Z",
    "verified_at": "2026-09-13T16:00:00Z",
    "verified_by": "E1"
  }
}

Summary

The signature plate shows certificate, document hash, TSA timestamp — visible and readable without special tools.
The hash chain anchors source document → signature doc → PDF; each link is separately verifiable.
PAdES-B-T (with LTV upgrade) is the typical FES format.
Next article (DS09): the envelope report — the DocuSign-style case documentation in the repo.

Created: 260913 | Part II, Article DS08 | Series: digital-signage