What a certificate does and does not establish

Every document signed through ChekSign carries a certificate. It states what the system actually did, and it is written to be read by somebody who has never heard of us: a regulator, a court, or an incoming auditor. So it is candid about its own limits.

What the certificate establishes

That a particular file, fixed by its SHA-256 hash, was presented in full to each named recipient; when each of them opened it and when they signed; what identity check was enforced on them at that moment, and what network connection they acted from; and the exact words each person affirmed, stored as they were shown rather than recomposed afterwards.

It also establishes that the file has not changed since. Upload your copy at the verify address printed on the certificate and it is compared byte for byte against the record.

What it does not establish

• Who the person was. No identity document was checked and no third-party identity check was made. Where a link was emailed, the record shows that someone with access to that mailbox acted, not who they were.
• That they were authorised to sign for anyone but themselves. That depends on the organisation's own governance, which ChekSign does not verify.
• That they read or understood the document. Only that it was presented in full and a deliberate action was taken.
• That the email arrived. The record shows the link was issued, and separately whether a mail server accepted it. Delivery, opening and reading are not tracked.
• What an IP address means. It identifies a network connection, not a person or a place, and where a proxy sits in between it identifies the proxy.
• Non-repudiation in the cryptographic sense. There is no signer-held private key and no digital signature inside this PDF. A hash proves the file has not changed; it does not prove who produced it.

Why this is not printed on the certificate itself

It used to be. Seven paragraphs of limitations on the page a client files made the whole document read as boilerplate, which is how a disclosure stops being read at all. The certificate now carries one neutral line about what identity was confirmed by, and points here for the rest. Nothing has been softened. This page is the same list, in full, and the certificate says where to find it.

The hash on the certificate

The certificate prints the hash of the document AS PRESENTED for signature, not of the finished file. A document cannot contain a hash of itself. Both are registered, and /verify recognises either, and it tells you which one you have, because a presented copy is genuine and is NOT the executed document.