01
Changes after signing.
Verification detects changes to signed data and an inconsistent event chain. A different file is detected by file comparison. The record key also needs an independent basis for trust; a new self-signature does not confirm a known identity.
02
Manipulation before signing.
A compromised recorder or a controlled operating system can provide false observations. A valid signature does not make those claims true. A stolen key can also sign unauthorised records. Key management and device integrity remain critical assumptions.
03
Time and missing events.
Local clock values are not independently attested timestamps. The verifier checks ordering and flags detectable clock discontinuities. A consistent chain does not establish that every relevant event was captured. Interrupted and empty sessions receive their own notices.
04
Outside the observed device.
Second devices, previously received assistance and copying an AI output cannot be ruled out using local input signals alone. A record describes observations within its capture scope. Substantive decisions require appropriate rules and an opportunity to explain discrepancies.
