The problem
Recipients need a reliable way to determine whether a document has changed and whether a trusted signing key produced its signature. The platform separates fingerprint generation, signing and verification into explicit API workflows.
Architecture
Document
Input bytes
→Input bytes
FastAPI service
Hash · sign · verify
→Hash · sign · verify
Verification result
Signature + fingerprint
Signature + fingerprint
Trust boundary: private signing keys and uploaded documents require distinct access, storage and lifecycle controls.
Engineering decisions
- SHA fingerprints provide a compact, reproducible identity for document bytes.
- RSA signature workflows distinguish authenticity from simple checksum comparison.
- FastAPI exposes operations through a typed REST boundary and supports clear request validation.
- Signing and verification are separate operations so clients can be granted narrower capabilities.
Security properties
- A changed document produces a different fingerprint and fails signature verification.
- Verification can occur without access to private signing material.
- Explicit API boundaries support logging, authorization and rate controls.
Honest limitation: production trust depends on key provenance, certificate policy, protected private-key storage, canonical file handling and operational audit trails. The portfolio project demonstrates the workflow; it does not replace a managed PKI or HSM-backed signing service.
Evidence status: Public repository and engineering case study. Production readiness is not claimed.