Show HN: Let's Seal – Let's Encrypt for document signing, free and self-hosted

TLDR, Let's Seal gives the finger to Adobe and every doc signing tool (docusign, google, etc) who pay to play with the Adobe Approved Trust List and then charge you for something that should be free. Currently even the person checking if a document/contract is sealed or code is authentic has to also be inside the same Adobe walled garden too. Verification, the part that should be free is the part everyone charges for. Thats the shape Let's Encrypt fixed for TLS, and I wanted the same thing for documents and files. The core idea therefore needed to go a bit beyond e signatures and i created an open standard (SEAL), plus free tools that implement it. When you seal a file, three independent things happen. 1. it gets a signature from a certificate authority, chaining to a public root. 2. its record is appended to an RFC 6962 transparency log. and 3. its SHA256 is timestamped on a public blockchain (Bitcoin) via OpenTimestamps. Those three give you integrity, transparency and a timestamped proof. And importantly, none of those depend on Let's Seal and none are gated. You can verify with the tools you already have, no Let's Seal account and no Let's Seal software. A sealed PDF carries a standard PAdES signature, so any PDF reader validates it. A sealed build artefact carries a cosign compatible signature and a SLSA provenance attestation. The Bitcoin timestamp verifies with stock ots. 3 ways to use it. 1. The free web app. We kindly have backing from Backblaze to cover storage costs for the foreseeable. So you can upload or issue any number of documents, get a public proof page at /d/ and verify it at https://verify.letsseal.org for free. Multiple accounts, multiple seats, enterprise functions. Free. 2. Self host the whole thing. Apache-2.0, one Next.js app plus a signing service that holds the CA key on localhost. Storage is any S3-compatible bucket or local disk. If you'd rather run your own root of trust, you can. 3. Programmatically. via the CLI and a hosted API