A Signature That Proves Time

In the notarial offices of medieval Italy, a notary didn't just witness a document. He marked it with something called a signum, a unique, hand-drawn symbol, part geometric design and part personal flourish, that he used consistently across his entire career. No two notaries' signa looked alike, and a working notary used the same one on every single document he ever notarized, for decades.

This wasn't decoration. It was a specific technology for a specific problem. A notarial act needed to prove two things that had nothing to do with secrecy: that the document existed in this exact form, and that it existed no later than the date written on it. The notary's seal pressed into wax didn't hide anything. Unlike a letter sealed for a recipient's eyes only, a notarial document was often meant to be read by anyone with standing to see it. What the seal and the signum protected was the document's integrity and timing, not its contents.

And here is the detail that still strikes me centuries later: a notary's signum remained verifiable after he died. Other notaries, courts, and successors kept registries of known signa specifically so that a document surfacing decades later, long after the notary who made it was in the ground, could still be authenticated by comparing the mark against the historical record. The proof was built to outlive the person who made it.

I think about medieval notaries every time someone tells me encryption and proof are the same category of problem. They are not. One hides. The other witnesses. And almost nobody building software today seems to remember that these were always two separate crafts.

When "It Never Happened" Becomes the Whole Argument

There is a specific, maddening kind of powerlessness that comes from being unable to prove something existed, when you're certain it did.

A contract that got quietly edited after both parties signed it, and now only one version exists, on a server you don't control. A piece of evidence a journalist collected that a source later claims was fabricated, with nothing except the journalist's word standing against the denial. A creative work whose first version vanished into a platform migration, leaving no record of when the idea actually originated, just whoever's version survived the server move. A medical record that says one thing today and, if you'd checked it eighteen months ago, said something slightly different, and no way to prove which version is the lie.

In every one of these situations, the person holding the actual truth is structurally disadvantaged against the person holding the server. Not because they're wrong. Because "what happened" has quietly become identical to "whatever the database currently says," and databases get edited, migrated, and reinterpreted by whoever has administrative access, usually not the person who needs the proof.

This is a particular kind of exhaustion that doesn't look like the time tax or the password fatigue this series has already covered. It's the exhaustion of being right and having no way to demonstrate it, because the only witness to the truth was a system designed to be rewritable by someone else, at any time, without leaving a trace anyone outside that system could independently check.

Two Different Promises, Never to Be Confused

Everything Coopa has built around encryption, the material covered across this entire series so far, answers one kind of question: can anyone besides you see this? The honest answer, by design, is no.

Mühür, the Turkish word for seal and the name we gave this layer, answers a completely different question, one that has nothing to do with hiding anything: did this exist, unchanged, at this specific moment, and is there a way to check that doesn't require trusting me to tell you the truth about it?

These are not variations on the same idea. They are opposites in a specific, important sense.

Encryption makes something unreadable to everyone except you. A notarial proof is often meant to be checked by people who have never met you and never will: a future employer, a court, a stranger verifying a claim, someone auditing a provenance record decades from now. The entire point is that it works without requiring trust in the person presenting it. It has to stand on its own.

So when Coopa seals something this way, nothing about the content gets hidden. What gets locked down is the shape of a moment: this exact file, these exact bytes, existing at this exact point, witnessed by someone willing to put a verifiable mark on having seen it. Change a single byte afterward, and the proof no longer matches. Not because a policy forbids tampering. Because the mathematics simply stops lining up the moment anything differs from what was originally witnessed.

Proving You Didn't Reach Into the Past

Last week ended on a question: what would it take for a signature to prove not just who, but when? Underneath it sits a problem that sounds abstract until you actually try to solve it. How do you prove something was signed on a specific date, rather than signed today and quietly labelled with an earlier one?

A date typed into a form proves nothing. Anyone can type any date. This is the exact weakness that made medieval notarial registries necessary in the first place, and it's a weakness that most digital "timestamps" never actually solve, because a server clock is just as editable as the data it's timestamping.

The way Coopa handles this is almost elegant in how little it invents. Rather than trusting any clock, the signing process reaches out and grabs a fact that an enormous public ledger has already independently agreed happened, the most recent confirmed state of a public blockchain at that exact moment, and weaves it permanently into what gets signed. The resulting proof doesn't just say "I signed this." It says "I signed this no earlier than a moment the entire world had already, independently, agreed had occurred." You cannot reach backward and fabricate that condition after the fact, because you cannot retroactively make the world agree that a past moment hadn't happened yet.

This is the digital version of a notary dating a document by referencing something publicly, independently known to have already occurred. The difference is that instead of relying on one notary's word that today's date is today's date, it relies on a fact an entire decentralised network has already settled, permanently, before you ever signed anything.

Why One Signature Was Never Going to Be Enough

Last week I told you that among the keys born from your twelve words, one is built to outlast the cryptography most of the internet runs on today. This is what that key is for. Coopa doesn't seal something with a single signature. It layers two, built on entirely different mathematical foundations, independently.

The first is the kind of signature this whole series has already described: the cryptography underpinning almost everything digital today, resting on mathematical problems that are, as far as anyone has proven, catastrophically hard to reverse with any computer that currently exists. The second is built on a newer, stranger category of mathematics specifically designed to remain hard to reverse even by a fundamentally different kind of computer, one that doesn't fully exist yet, but that serious researchers are actively trying to build, precisely because it would break the first kind of signature if it succeeds.

This isn't paranoia dressed up as engineering. It's a direct consequence of what a proof like this is actually for. A proof that says "this existed, unchanged, on this date" is not a claim meant to matter for a few months. It's meant to still mean something in twenty years, in fifty, long after today's cryptographic assumptions might have aged out of relevance. If we'd built Mühür on a single signature method and that method were ever broken by some future advance, every proof ever sealed under it would become retroactively worthless, not because the event it witnessed stopped being true, but because the mathematics proving it had quietly expired. The second signature exists because we were unwilling to let a proof's expiration date sneak up on the people who'd trusted it.

Verified Without Asking Anyone's Permission

There's one more property worth sitting with, because it's the part that actually completes the notarial parallel rather than just echoing it.

A proof sealed this way doesn't depend on Coopa existing to check it. The verification process was deliberately built to stand on its own: nothing to ask us, no login, no account, no dependency on anyone's company staying solvent. Years from now, if Coopa the company no longer exists, someone could still open that same small verification tool from a copy sitting on a USB drive, point it at the original file and its proof, and get a real answer, because the actual checking happens locally and against public, independently verifiable records, not against anything only we control.

This is the signum again, almost exactly: a mark meant to remain checkable long after the hand that made it is gone, against a record nobody needs our permission to consult.

And there's a quieter design decision buried in here that I think matters as much as the cryptography. The ability to revoke a seal is deliberately public. Anyone can attempt it, not just the original signer, because we wanted a path for someone coerced into sealing something falsely to be able to undo it even under duress. But that openness could obviously be turned into a weapon, a stranger falsely "revoking" someone else's honest proof out of malice. So the system was built to treat an outsider's revocation attempt not as a deletion, but as a disputed flag sitting alongside a seal that remains otherwise intact: visible, honest about the disagreement, but not erased by someone who was never party to it in the first place.

What a Proof Still Can't Protect

Everything in this piece has been about witnessing a moment: this file, these bytes, this instant, signed by keys that, as last week showed, were born from nothing but twelve words and live nowhere but with you.

But a proof is a statement about a file. It says nothing about the place the file lives. You can seal a document so precisely that no one can alter it without the mathematics noticing, and still lose it the day the service holding it changes its terms, raises its price, or simply decides your account no longer fits. The seal would still be valid. It would be a perfect proof of a file you no longer hold.

We have spent weeks on locks, signatures, and proofs. We have not yet asked the quieter question underneath all of them: who owns the building the files live in?

Next week, we walk inside. And we ask what separates a drive that stores your files from one that is, in any meaningful sense, yours.