notes: research/papers/hardman-who-is-signing

This data as json

path title type status classification words body
research/papers/hardman-who-is-signing Who Is Signing? summary v0.1 — 2026-10-15: drafted by Claude from the HTML page (version 1.0); unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only partner 449 # Who Is Signing? **Abstract.** A short 2026 analysis by Daniel Hardman arguing that "who is signing?" rarely has one answer, because signatures sit where keys, delegation, intent, governance and accountability meet. It offers a lifecycle view of signing and a richer set of questions for verifiers, and is for anyone reasoning about signatures in decentralized identity, PKI (public key infrastructure), credentials and agentic AI. ## Summary The analysis begins with an analogy: a pilot hands the controls to a trainee on a plane owned by one airline subsidiary and marketed by another, so who is flying depends on whether a lawyer, a regulator, a passenger or an insurer is asking. Signing, it argues, has the same dynamic. The naive model holds that a signature proves control of a private key, so the signer is whoever controls it. That is a useful first step but breaks down for organizations, which act through employees, contractors, automation and keys held in hardware modules behind policy engines. A signature can mean authorship, witnessing, assertion, endorsement, authorization or acting for someone else. The article sets out a lifecycle: issuers sign credentials asserting facts, subjects sign collections of evidence they stand behind, and delegated signers sign live artifacts under delegated authority. Delegation is described as normal, with opacity as the risk. Multisignature identifiers, citing the KERI (Key Event Receipt Infrastructure) specification, can make thresholds and role separation visible, while most common tools hide governance behind a single key, so a governed process and a leaked secret look the same from outside. The same concern applies to agentic AI. Signatures sit at intent boundaries, where outsiders infer purpose from action. It closes with five questions to ask instead: who controlled the key, in what role, whose intent is represented, what authority links the signer to an accountable principal, and which of these are inspectable. ## Key terms signer, key control, delegation, evidence lifecycle, multisignature identifier, governance, intent boundary, accountable principal ## Claims and their evidence - Signing proves someone processed content but does not by itself state their intent toward it. [informative] - Issuer, subject and delegated signatures play different roles at different points in an evidence lifecycle. [informative] - Multisignature identifiers can expose signing thresholds and recovery to observers, citing the KERI specification. [informative] - Most tools in common use hide governance behind a single key, making it indistinguishable from a lone script with a leaked secret. [informative] ## Related Signing Doesn't Always Claim Authorship; The Evidence Lifecycle in Telco; Why Anchored Signatures?; Intent and Boundaries: A Framework for Digital Agency; KERI specification ## Provenance Drafted by Claude on 2026-10-15 from the HTML page at dhh1128.github.io/papers/who-sign.html, read in full. Not yet read by Mark.

Links from other tables