Portable signed text lets someone send a message with evidence of the device that signed it and the persona that device belongs to. The recipient can verify that evidence locally, then separately ask whether their own trust reaches the sender.
Three checks, three meanings
| Check | What it establishes |
|---|---|
| Content signature | The normalized text matches the statement signed by the device key |
| Issuer-signed device certificate | The issuer attested that key's membership in the named persona |
| Recipient's verified reachability query | A qualifying path from the recipient's persona to the sender in the cited graph commitment |
Do not merge these into a single unexplained “verified” label.
Create a portable message
The sender requests a certificate for their own device and node, verifies the issuer and selected key/node, then creates a content statement. createContentStatement hashes text after lf-v1 normalization: CRLF and CR become LF. It does not strip whitespace or normalize Unicode.
signer.signContent signs the statement. formatSignedContent appends a canonical evidence block. The statement commits to the whole membership certificate, including its random certificate identifier.
The recipient uses parseContentMessage and verifySignedContent with pinned issuer verification and cryptographic adapters. Parsing rejects ambiguous markers, extra text and malformed evidence.
Check current status separately
A certificate can have a valid signature even after expiry or revocation. A fresh signed certificate-status response binds the certificate digest and a caller nonce. The SDK checks the issuer and a 60-second freshness bound.
Status checks send the certificate and nonce, not the message plaintext or content hash. If status is not checked, label it “status not checked”. Offline verification does not become a current-valid claim.
Does not establish
A valid content signature does not prove when the text was signed, current device access, delivery, recipient trust, historical validity, or permission to act. A sender-chosen date is not signing-time evidence.Add the recipient's perspective
After verifying the sender evidence, query reachability from the recipient's own node to the sender's stable node. Verify the returned attestation locally using the same rules as the quickstart.
Signed messages applies this pattern to mail and text channels. OpenPGP keys and Git signer membership use related membership checks for existing signing keys.