One timestamp receipt, taken apart layer by layer. Every receipt in the estate carries several independent kinds of time evidence: a local hash, an RFC 3161 token, an OpenTimestamps Bitcoin anchor, a Sigsum log leaf and a signed-note checkpoint cosigned by a witness set. Each layer is verified on its own, and each one proves something different. The numbers on this page are quoted from the estate's own configuration files and carry the file they came from and the date they were measured.
A timestamp receipt is not one signature. It is a stack of evidence, produced by independent systems, that a given hash of bytes existed at or before a point in time.
The layers do not trust each other. If one authority disappeared, its key were lost, or one log turned out to be misbehaving, the other layers would still stand, because each binds the same digest through a different path with a different trust root. That independence is the design: the receipt stays checkable as long as any one of its layers checks out. This page walks one receipt through every layer and ends with what each layer proves and what it never proves.
Before any authority is involved, there is only arithmetic. SHA-256 over the artifact's canonical bytes produces a digest anyone can recompute, offline, forever.
Everything after this step is evidence about this digest, not about the artifact directly. That is why the layers can be independent: they each answer the same question, "had this exact digest been computed by such a time?", through different authorities. The digest value on this page is illustrative and visibly truncated; the real estate computes it through the inline canonicalization path the execution_hash system uses.
A Time Stamp Authority signs a token that binds the digest to a clock reading. The token is DER encoded, and its fields say who stamped, when, and under which serial number.
The token's meaning is narrow and precise: the authority asserts that the digest in the messageImprint was submitted to it no later than genTime. The field values above are illustrative. The estate does decode real RFC 3161 tokens today, through the shared parsing logic in chaingraph/kernels/_rfc3161.mjs, and the art-122 verifier lets you paste a token and read its fields in the browser.
OpenTimestamps aggregates many digests into a Merkle tree and commits the root in a Bitcoin transaction. The block's own header timestamp then covers every digest in the tree.
The trust root here is the Bitcoin chain itself: rewriting history would mean rewriting the block. The proof OpenTimestamps returns is the Merkle path from your digest up to the root that the block committed, so checking it later needs only the proof file and the block header. It bounds time from above: the digest existed when the block was mined, and the block's timestamp says when that was.
The estate also submits the digest to a public Sigsum log. The log folds each submission into an append-only Merkle tree, and every tree head it publishes is cosigned by independent witnesses, which the next step covers.
A Sigsum proof is an inclusion path: the leaf hashes up through the tree to the root that the published checkpoint carries. The log the estate uses is quoted from the anchor configuration: the log URL is https://seasalp.glasklar.is and the log public key is 0ec7e16843119b120377a73913ac6acbc2d03d82432e2c36b841b09a95841f25, both measured 2026-10-23 from anchor-suite/public/lib/sigsum.mjs (exports LOG_URL and LOG_PUBLIC_KEY_HEX). Inclusion in a signed, witnessed tree is what lets anyone later hold the log to a consistent history.
A tree head on its own is a claim by one operator. The C2SP signed-note format wraps it as a checkpoint, and independent witnesses add cosignatures over the same head, under a cosignature/v1 namespace, until a k-of-n quorum is met.
| Witness | Public key (hex) |
|---|---|
| witness.glasklar.is | b2106db9065ec97f25e09c18839216751a6e26d8ed8b41e485a563d3d1498536 |
| witness.mullvad.net | 15d6d0141543247b74bab3c1076372d9c894f619c376d64b29aa312cc00f61ad |
| tillitis.se/tillitis-witness-1 | 076be8c9ee7ea60916f0df3608c945d7730082ecb37749dad2c9ed339fea770c |
| ArmoredWitness-falling-pond | 54c4862caba4ef942fe1abc6afb65d63cba0a55d3e6313ff59154b8586d882e2 |
| ArmoredWitness-wispy-wood | 456f659e0b0efa658e3a2895e2775a7c6754ae09d5842241bb603d649517068f |
| ArmoredWitness-quiet-wood | 9b71799be731b15fe9b54f37cd6f22f9499d3e3309dabcb588bf82e234844913 |
| ArmoredWitness-morning-darkness | 7ba003654674398b62dd70ab369a3f750a48670354d66f79125827514a0b9fbd |
| ArmoredWitness-shy-wind | 198bed2687bcf60fc246eae3583f2a9764287ece65aa1aa9f2b6b04a1628be1d |
| ArmoredWitness-hidden-river | dae934c7cc1f45ba898a3dfe1265d492a6c58405ddec143fc16f84a0f588e3a5 |
| ArmoredWitness-throbbing-bird | 98149a5d739b3baa777128f617531ce8b654d24502a7e151244cc5b7597667bc |
| ArmoredWitness-rough-wind | ea31934afb8632958de2fb37dd9bfabb8dc7961dea67a6ae4c57f1a1ca26eef7 |
| ArmoredWitness-floral-sky | e90299398a4d39d030da888a0923ecf16786881ac12243db73c9f0cf2a2d80e6 |
Every name and key above is quoted verbatim from anchor-suite/public/lib/sigsum.mjs, export const WITNESSES, measured 2026-10-23; nothing on this panel is hand typed. The quorum rule comes from the Sigsum project's vetted policy, sigsum-generic-2025-1, which requires 2 of its 3 named witnesses (measured 2026-10-23 from chaingraph/policies/sigsum-generic-2025-1.tlog-policy, line group quorum-rule 2 witness.glasklar.is witness.mullvad.net tillitis.se/tillitis-witness-1). Verification stays k-of-n against that policy: cosignatures from the nine pinned ArmoredWitness devices beyond the quorum add display detail, and an unknown cosigner is simply skipped. The ArmoredWitness entries are hardware devices from the transparency-dev project's public production attestations, per the comment block in the same file. Try the checkpoint and quorum check yourself in the live tool: the C2SP checkpoint verifier.
Each layer answers a narrow question. Reading a receipt means knowing which question each layer answers, and which ones it leaves open.
| Layer | Proves | Never proves |
|---|---|---|
| Local hash | The artifact's bytes produce exactly this digest; anyone can recompute it. | When the bytes existed. A hash alone carries no time at all. |
| RFC 3161 token | An authority asserts the digest was submitted to it no later than genTime. | That the submitter described the content truthfully, or that the authority stays trustworthy past its certificate's life. |
| OpenTimestamps | The digest was committed in a Bitcoin block by the block's header time. | Who submitted it, or anything about the content. It also waits for the block: newer digests are pending until inclusion. |
| Sigsum log leaf | The digest entered an append-only, publicly auditable tree with a consistent published history. | Wall-clock time on its own. The log orders entries; a clock reading comes from the witness timestamps around the checkpoint. |
| Checkpoint + witness set | The tree head was seen and cosigned by independent parties, so one operator cannot rewrite history unnoticed. | That any witness saw every head, or that the digest's content means what a submitter says it means. Split-view detection still needs an independent observation of the log. |
The shared shape across layers 2 to 5 is a bound of the form "existed at or before T". None of the layers identifies the submitter, endorses the content, or makes the artifact more true. A receipt is evidence about bytes and time, and every claim built on top of it is a separate claim with its own evidence.
Every layer so far binds a time. A different mechanism binds order instead: Provenance Marks, from Blockchain Commons, chain records forward so a reader can show one record came before another, with no clock and no blockchain.
Positive scope, stated plainly: a provenance mark chain orders events; it carries no time. The mechanism and its field structure are published as BCR-2025-001 by Blockchain Commons (bcr-2025-001-provenance-mark.md), where it carries a beta marker; the specification text is CC BY-SA 4.0, and this page describes the idea in its own words with the source linked rather than reproducing it. If a mark later tried to insert itself into an existing chain, the forward commitments would no longer line up, which is the same append-only logic a transparency log applies to its tree.
One estate receipt really does carry these layers. Follow the same artifact through the anchors that are live today, then see what the estate keeps doing and what it leaves as a design.
chaingraph/kernels/_rfc3161.mjs.anchor-suite/public/lib/sigsum.mjs, and the checkpoints are verifiable offline.parent_hashes, which order linked artifacts by construction; the graph gives order, and the anchors give time.The claim tags follow a fixed rule: "does today" names a shipped estate behavior, cited to the file or page that carries it; "design" names an idea this page describes but the estate has not built. Nothing on this page should be read as a certification of any content, an audit of any party, or a promise about any third-party log; the receipt layers are evidence about bytes and time, and each layer's limits are in the table above.