Verifiable evidence formats, compared
What each one proves, and when to reach for which.
loomseal.com · Reading
What each one proves, and when to reach for which.
loomseal.com · Reading
The tools in this space share a vocabulary, signing, attestation, transparency, and answer different questions. Picking the wrong one is common and expensive, so here is the honest map, including where the alternatives are the better choice.
| System | The question it answers | Third-party verification |
|---|---|---|
| RFC 3161 timestamps | Did this exact document exist by time T? | Yes, offline, via the signed token |
| Sigstore / cosign | Which identity signed this artifact? | Yes, against the public transparency log |
| in-toto / SLSA | How was this artifact built, by which steps? | Yes, attestations checked against policy |
| Certificate Transparency | Was this certificate publicly logged? | Yes, via inclusion and consistency proofs and public monitors |
| WORM storage | Has this stored copy been retained unmodified? | No. The guarantee is the storage configuration, trusted, not checked |
| LoomSeal | Is this operational history intact, anchored in time, and whole? | Yes, offline, one file plus a free open verifier |
If you are signing container images or release artifacts, use cosign; identity-bound artifact signing with a public log is exactly its job. If you need build provenance, who built this, from what, through which pipeline, in-toto attestations and SLSA levels are the established answer, with real ecosystem support. Certificate Transparency is the existence proof that population-level transparency works at internet scale, and if your problem is certificates, it is already solved. A trusted timestamp is the right tool whenever the whole question is that a document existed by a date. And WORM retention satisfies regulators that a copy was kept, which is a real requirement, just not a proof you can hand anyone.
Every row above except the last is scoped to an artifact, a build, or a certificate, or else it is not third-party checkable at all. The unclaimed question is operational history: the running record of what a system did, who approved it, and when, packaged so a stranger can check it years later without trusting anyone. That needs the whole stack at once: append-only linking, signatures, external anchors, offline verification, and, the part nothing else on the list attempts, a population commitment so silent omission becomes detectable. That last property is LoomSeal's LoomSpan profile: continuous signed counts, coverage reported as a measurement, never a badge.
These systems compose. A LoomSeal bundle can be wrapped in a DSSE envelope for tooling that expects one, uses RFC 3161 timestamps as one anchor type, and reserves a transparency-log anchor. The format's rules, including exactly what verification proves and what it deliberately does not, are public in the spec, and any bundle can be checked in the browser verifier.