A DocuSign / DocHub-style signing experience, rebuilt on biometric, face-sealed public/private keys, so every signature proves the actual person, not just an email address, and works with any digital file.
Signometric lets a sender package a document into a Seal, route it to one or more signers, and collect signatures that are cryptographically bound to (a) the exact content of the document and (b) a verified, living person. The result is verifiable by anyone, forever, without a Signometric account.
Three principles shape every decision below:
| Concept | What it is |
|---|---|
| Seal | The envelope for one signing job: the locked document, its content fingerprint, the list of signers and their roles, the signing order, and the collected signatures. |
| Keypair | Each signer has a keypair. The private key is sealed to their face (+ PIN) and is only ever reconstituted, in the moment, from a live capture. The public key is safe to share. |
| Certificate | A signed record in the directory binding a signer's handle to their public key, so a verifier can trust "this key belongs to this person." |
| Verification | Checking a finished Seal against the signers' public keys. Passes only if the content is byte-for-byte unchanged and each signature came from the right key. |
| Assurance level | How strongly a signer's identity is established (see §3). Chosen by the sender, per Seal, and can differ per signer. |
The people around a Seal take one or more roles. A single person can hold several (a sender who also signs, for instance).
| Role | Does what |
|---|---|
| Sender / Preparer | Drafts and dispatches the Seal. May or may not be a party (see §4). |
| Party | Is bound by the agreement and signs it. |
| Witness / Notary / JP | Attests that they observed a party sign, or applies an official act (a Justice of the Peace, notary, or commissioner). |
| Approver | Signs an internal sign-off rather than being a party to an external agreement. |
| Acknowledger | Confirms they received and read a document (no negotiation). |
| Verifier | Anyone who later checks the finished Seal. Needs no account. |
The sender decides how each signer reaches and is identified by a Seal. This is the "direct link vs. requires an account" choice, and yes, it makes sense, because it is really a single dial: how strongly do we need to establish who this signer is?
A key point: a biometric enrolment happens in every mode, because you cannot produce a face-sealed signature without minting a face-sealed key. What changes between modes is whether that identity is throwaway or durable, and whether it has been proofed against the real world.
| Mode | Signer experience | Identity it establishes | Good for |
|---|---|---|---|
| L1 Guest link | Opens the secure link, does a one-time face enrolment inline, signs. No lasting account. | "The same live person who enrolled a moment ago signed." Name/email are self-asserted. | One-off counterparties, low/medium stakes, fastest path. |
| L2 Account | Must sign in to, or create, a Signometric identity before signing. Face-sealed key is reused across documents. | A persistent, reusable identity. Repeat signers become recognisable. | Ongoing relationships, staff, frequent signers. |
| L3 Verified account | As L2, plus identity proofing: an ID document check, KYC, or a professional vouching in person. | The key is bound to a proven real-world identity. | Statutory declarations, deeds, regulated or high-value documents. |
Design note. Assurance is set per signer, not just per Seal. A property contract might let the buyer sign by guest link (L1) while requiring the witnessing Justice of the Peace to be L3. The sender picks a default for the Seal and can raise it for specific signers.
Whether the sender is also a signer depends entirely on the situation, so Signometric ships templates: pre-wired role maps, signing orders and default assurance levels that a lawyer or accountant picks at the start. Two axes describe them: is the preparer a party, and what roles do the signers play.
| Template | Preparer a party? | Signers & roles | Order | Default |
|---|---|---|---|---|
| T1 · Prepared agreement Your case (1): professional facilitates. | No, facilitator only (optional non-binding "prepared by" stamp). | Two or more Parties. | Parallel or sequential. | L2 / L3 |
| T2 · Statutory declaration Your case (2): professional participates. | Yes, as Witness / JP / notary, a participant with an official role. | Declarant (Party) then Witness (attests). | Sequential, often co-present. | Declarant L2+, Witness L3 |
| T3 · Peer agreement No professional involved. | Yes, the sender is one of the parties. | Party A (sender) and Party B. | Parallel or sequential. | L1 / L2 |
| T4 · Internal approval | No, an initiator routes it. | Approvers in a chain. | Sequential. | L2 |
| T5 · Bulk acknowledgement One-to-many. | No, an issuer. | Many Acknowledgers, each on their own copy. | Independent / parallel. | L1 / L2 |
| T6 · Multi-party agreement All-or-nothing. | Either. | Several Parties; completes only when all sign. | All-or-nothing. | L2 / L3 |
Templates directly answer "should sender and signer be the same or separate?" T1, T4 and T5 keep them separate (the professional facilitates). T2 makes the professional a separate participant with a witnessing role. T3 and T6 let the sender also be a party.
The default flow, told as a sequence. Steps in brackets vary by template and mode.
A Seal moves through a small set of states. The happy path runs left to right; the lower row shows the ways a Seal can end early.
Independent of who the signers are, a Seal collects signatures in one of four shapes. Templates pick a sensible default, and the sender can override.
Verification is deliberately independent of Signometric. A verifier needs only the finished Seal, the signers' public keys and their certificates (all shareable). The check confirms two things at once: the content is byte-for-byte what was signed, and each signature was produced by the key the certificate vouches for. If either fails, the Seal shows as invalid.
Every Seal carries a certificate of completion: an ordered record of each signer, their role, the time they signed, and the assurance level they met. Because it is bound into the Seal, the audit trail cannot be edited without breaking verification.
| Situation | Handling |
|---|---|
| Signer declines | Seal moves to Declined and notifies the sender. Nothing partially signed is treated as binding. |
| Sender revokes | Allowed until the Seal completes. Links stop working; state becomes Revoked. |
| Deadline passes | Seal expires; the sender can clone it into a fresh Seal to re-send. |
| Wrong person at the camera | Where a face is already enrolled for that party, the live capture is matched against it before a signing key is created; a mismatch stops the signing and is recorded. Where no face has been enrolled yet, the first capture establishes the identity (trust on first use), and the certificate says so rather than implying a match. Nothing to brute-force either way: the key is unsealed by the face, not by a password. |
| Correction needed after signing | Content is immutable once signed. Fix by issuing a new version as a new Seal (optionally superseding the old one). |
| Signing on behalf of a company | Handled as a role/authority attribute on the signer (for example "officer of the company"), still bound to the individual's face. |
| Witness co-presence (T2) | Optionally require the witness to sign within a short window of the declarant, or in the same session, to satisfy in-person rules. |
Signometric · Signing Workflow Specification · working draft v0.1. Diagrams are schematic and intended for discussion, not final UX.