Verifiable Evidence for Electronic Signatures: Per-Signer Timestamped Records, Hash-Chained Audit Trails and a Publicly Anchored Daily Seal Log

When a signer later says "that wasn't me", the evidence an electronic-signature service produces usually rests on the service's own word: an audit log in its database and a certificate it generated. We describe the evidence design used by agrmnt, an electronic-signature service, which aims to make each signed document checkable without trusting the service that produced it. Every audit event is hash-chained to the previous one. When a person finishes signing, a signing record committing to the exact document, the consent text, the identification evidence and the head of the audit chain is timestamped by an independent RFC 3161 authority. The finished PDF is sealed under PAdES with long-term validation data. Once a day, the fingerprints of all documents sealed that day are placed in a Merkle tree whose root is chained to the previous day's, timestamped by an RFC 3161 authority, anchored in Bitcoin through OpenTimestamps, and recorded in the Sigstore Rekor transparency log. Each evidence package ships with a dependency-free offline verifier. We describe the construction, report the tampering cases an adversarial test suite shows to be detected, and state plainly what this evidence cannot establish, most importantly that a timestamp proves when a record existed, not who acted.