Verification, explained

What a valid signature can tell you

A valid digital signature shows that the signed bytes match the signature made by the private key corresponding to a public key. With a valid certificate path to a trust anchor you accept, it can also connect that key to the name and usage in the certificate.

It does not mean a public certificate authority independently checked the person’s identity. The Enkiel Root CA is privately operated, and visitors should independently confirm its published fingerprint before trusting it.

Separate checks, explicit results

The current local verifier checks CMS signature mathematics, the file digest, and the signer certificate path to the configured Enkiel Root CA. It cannot yet check revocation. An ordinary signing-time attribute is only a signer claim; trusted time requires a validated timestamp authority token.

Supported formats, in phases

Generic files use detached CMS SignedData. Native PDF/PAdES signatures and S/MIME email signatures have format-specific rules and will be handled in later phases.