District Seal: the cryptographic evidence layer for high-value signatures
In 2026, standard e-signatures are no longer defensible in high-stakes transactions.
That is the premise on which District Seal was built — a cryptographic evidence layer for high-value signatures, produced by NEXSIM LLC, a Montana-registered company founded by Cameroonian engineer Etonde Fael Synclair.
This article is a full breakdown of the product. The problem it solves. How the six-step identity ceremony works. The cryptographic architecture. Every feature. Every page of the certificate. The pricing model. And why each design decision is what it is.
PART ONE: THE PROBLEM
Every major e-signature platform — DocuSign, HelloSign, Adobe Sign — was built on the same assumption: that if someone clicks a signing link from an email address, they must be the person that email belongs to.
The audit trail those platforms generate shows three things:
An IP address.
A timestamp.
A typed name in a signature field.
None of those prove identity. Under the ESIGN Act and UETA, a signature is legally binding only if the identity of the signer is “reasonably verifiable.” An IP address is not reasonably verifiable when a signer actively disputes their signature.
When a client claims “I never signed that, my email was compromised,” an IP log fails in court. That has been true for two decades, but it did not matter before. It matters now, because of three converging forces.
FORCE ONE: AI DEEPFAKES
Deepfake fraud attacks rose 180% year-over-year in 2026 according to LexisNexis Risk Solutions. Deepfake documents now account for 80.10% of AI-enabled fraud. A fraudster can produce a photorealistic face, a synthetic voice, and a forged passport in minutes using free tools.
Traditional document forensics fails against AI-generated forgeries. As LexisNexis put it: AI-generated documents “may contain several smaller defects that are harder for manual reviewers to detect.” Human reviewers correctly identify deepfake videos only 40% of the time — worse than a coin flip.
FORCE TWO: BIOMETRIC PRIVACY REGULATION
Illinois BIPA — the strictest biometric privacy statute in the United States — has generated class actions targeting Apple (6.5 million-person class), Nvidia, Otter.ai, and nine other technology companies. Settlements have reached $6 million.
BIPA requires informed written consent before collecting a biometric identifier. It provides a private right of action with statutory damages of $1,000 per violation, or $5,000 for reckless violations. At class-action scale, those numbers become existential.
The 2026 wave of BIPA class actions is different from previous ones. It targets AI training data and cloud-hosted biometric media. Any platform that uploads a signer’s face or voice to a central server is exposed.
FORCE THREE: COURT SCRUTINY
Courts have begun rejecting click-to-sign evidence more frequently. Judges recognize that IP addresses prove nothing about who was present at a screen. The ESIGN Act’s “reasonably verifiable” standard was written for a pre-AI world.
In 2019, a federal court rejected a DocuSign audit trail in a contract dispute after the signer claimed their email was compromised. In 2024, a similar case in Texas reached the same conclusion. The trend is one-directional.
PART TWO: WHAT DISTRICT SEAL IS
District Seal is not a replacement for DocuSign. It is an evidence layer that runs on top of any document signing workflow.
Every signing ceremony produces a five-page court-formatted certificate that binds a signer’s identity to the exact document by SHA-256. The certificate is cryptographically signed. It carries a public QR code that any third party can scan to independently verify the signature without needing an account on the platform.
The certificate is not a PDF with an image of a signature. It is a forensic record designed to hold up under cross-examination.
PART THREE: THE SIX-STEP IDENTITY CEREMONY
Every signing ceremony runs the same six checks in the same order. The order matters — each step depends on the integrity of the one before it.
STEP 01 — WEBAUTHN HARDWARE AUTHENTICATION
A W3C standard built on FIDO2 public-key cryptography. The signer’s device generates a cryptographic key pair. The private key lives in the device’s secure hardware — Apple Secure Enclave, Android TPM, or a YubiKey. The server sends a challenge; the device signs it.
What it proves: Possession of a specific physical device. Cannot be spoofed by a password. Cannot be spoofed by a cloned browser session. Cannot be spoofed by a deepfake.
What is recorded: Credential ID hash, user verification flag, signature counter, AAGUID, format.
STEP 02 — FORCED DOCUMENT SCROLL
The Sign button remains disabled until the signer has scrolled through 100% of the document.
What it proves: Informed consent in the legal sense. The signer cannot claim they never saw the terms.
What is recorded: Exact scroll percentage at the moment of complete exposure, with a UTC timestamp.
STEP 03 — RECORDED VERBAL CONSENT
The signer states on camera that they agree to sign the document.
What it proves: Audio-visual record of intent to enter a contract. Cannot be later disavowed without contradicting the recording.
What is recorded: The consent statement, timestamp, and a hash of the recording.
STEP 04 — RANDOMIZED SPOKEN CHALLENGE PHRASE
The server generates a three-word phrase — for example “nine fourteen twenty-two” — and displays it on screen. The signer speaks it aloud. Speech-to-text verifies the exact words.
What it proves: Defeats pre-recorded video replay attacks. The attacker cannot predict the phrase, so a video of the signer saying “I agree” from last year is useless.
What is recorded: The challenge words, the transcript, the exact text-match confidence score, and whether the match passed.
STEP 05 — HEAD-TURN LIVENESS CHECK
The system prompts the signer to turn their head left, then right. The camera tracks movement and depth.
What it proves: Defeats 2D photo spoofing and flat printed masks. Only a real, 3D human head passes.
What is recorded: The maximum swing angle in degrees, the number of valid pose readings, and whether the movement passed the threshold.
STEP 06 — BIOMETRIC FACE MATCH
A frame captured during the liveness check is compared against a reference photograph uploaded by the sender.
What it proves: Confirms the person completing the ceremony is the person the document was intended for.
What is recorded: The ArcFace distance score, the configured threshold, and the match decision. The reference photo is retained for 30 days, then destroyed.
PART FOUR: THE DURESS PROTECTION SYSTEM
Every high-value signature can be coerced. The question is not whether coercion happens — it is whether the platform is designed to catch it.
District Seal includes a duress channel that works from the signer’s side without the coercing party knowing it exists.
HOW IT WORKS
Every certificate is issued with a reference number visible on the form. If a signer is being forced to sign, they can email duress@districtseal.com with that reference number. District Seal responds within 24 hours and flags the certificate as “under dispute” on the public verification page.
WHAT HAPPENS AFTER A DURESS FLAG
The certificate is not revoked. Revoking it would tip off the coercing party.
Instead, three things happen silently:
The public verification page for that certificate adds a “dispute pending review” indicator visible only to credentialed verifiers (attorneys, regulators, courts with the reference number).
District Seal’s verification office is notified. A human reviews the transaction and can escalate to law enforcement or the signing party’s counsel.
The signer’s email and phone number are kept on file for a 30-day review window. During that window, the signer can add a written statement that becomes part of the evidence package.
WHAT THIS IS NOT
District Seal is not a law enforcement agency. It cannot stop a signature that has already been affixed. What it can do is produce a forensic record that a court can use to establish that the signature was made under duress — a defense that would otherwise be impossible to prove because the coercing party controls the narrative.
The duress channel is printed on every certificate. It appears on the “If you were forced to sign” panel on the signing completion page, and it is documented in the certificate’s footer.
PART FIVE: THE CRYPTOGRAPHIC BACKBONE
SHA-256 DOCUMENT BINDING
The moment a document is uploaded, District Seal generates a SHA-256 hash — a 64-character alphanumeric string that functions as a unique digital fingerprint.
The certificate is bound to that hash. If a single character in the document changes after signing — a dollar amount, a date, a name — the hash changes completely. The certificate no longer validates. The seal breaks.
This is different from a PDF signature image. A PDF signature image can be edited with the right software. A SHA-256 hash cannot be forged without recomputing the entire document, and the certificate was produced before any alteration was possible.
PUBLIC VERIFICATION
Every certificate carries a public QR code. Scanning it opens a verification URL where the server recomputes the hash of the document in hand and confirms whether it matches the hash recorded in the certificate. No login. No phone call. Just a cryptographic match or a mismatch.
Any third party — a court, a regulator, a counterparty, an employer — can verify a certificate independently. There is nothing to trust about District Seal itself. The math is the trust.
EVIDENCE MANIFEST
Each transaction produces an evidence manifest — a separate SHA-256 hash of the complete forensic record. The manifest hash is printed on the certificate as a short “ledger seal” (for example DS·647F·799E) so it can be referenced verbally, in email, or in a legal filing.
PDF DIGITAL SIGNATURE
The certificate PDF is itself digitally signed by the District Seal verification node. Any modification to the PDF invalidates the digital signature. This is different from the document hash — the document hash protects the underlying contract, the PDF signature protects the certificate itself.
PART SIX: THE ZERO-MEDIA-RETENTION ARCHITECTURE
This is what makes District Seal legally deployable in jurisdictions with strict biometric privacy laws.
Get Etondefaelsynclair’s stories in your inbox
Join Medium for free to get updates from this writer.
All voice and video processing happens on the signer’s device, in the browser. Raw media never leaves the browser. When the ceremony completes, the raw video and audio are destroyed on the device.
What District Seal retains is limited to mathematical proofs:
The SHA-256 hash of the signed document.
Text-match confidence scores for the spoken challenge.
Liveness check results.
A forensic timeline with UTC timestamps.
The reference photograph for 30 days, then destroyed.
None of these are biometric media. None can be used to reconstruct a face or voice. None can be breached.
If a server holding District Seal data were compromised, the attacker would get hashes and timestamps. Not faces. Not voices. Not the material that fuels downstream identity fraud.
This is what makes District Seal compliant with Illinois BIPA and California CCPA in a way that cloud-biometric platforms are not. There is no biometric media to breach because no biometric media is stored.
PART SEVEN: THE FORENSIC TIMELINE
Every transaction produces a server-side forensic timeline with UTC timestamps. This is what makes a certificate court-admissible — not the biometric checks themselves, but the record of every event that occurred.
Events recorded in the timeline include:
Signing link opened.
WebAuthn challenge issued.
WebAuthn credential verified.
Focus lost (with cause: window blur, tab visibility change, fullscreen exit).
Document exposure complete (scroll_pct).
Informed consent accepted.
Liveness challenge issued.
Liveness challenge completed.
Biometric capture received.
Verification passed or failed.
Certificate issued.
Certificate emailed.
Certificate verified by third party.
Each event includes UTC timestamp, event type, and event-specific metadata. The timeline is bound to the evidence manifest hash and cannot be modified after issuance.
PART EIGHT: THE CERTIFICATE
Every District Seal signing produces a five-page certificate. Each page serves a specific purpose.
PAGE ONE — DOCUMENT SUMMARY
The underlying document, the signer’s name and email, and the cryptographic vault data (document hash, evidence manifest hash, ledger seal). Includes the transaction reference number, creation timestamp, and verification status.
PAGE TWO — CERTIFICATE OF BIOMETRIC SIGNATURE
The transaction reference, creation timestamp, verification timestamp, ArcFace distance score, threshold, and MATCH decision. Includes the public verification QR code.
PAGE THREE — FORENSIC ANALYSIS CHRONOLOGY
Every event in the signing ceremony, recorded server-side, with UTC timestamps. Includes WebAuthn challenge issue, credential verification, document exposure completion, consent acceptance, liveness challenge issuance, capture.
PAGE FOUR — CRYPTOGRAPHIC CHAIN OF CUSTODY
The document SHA-256, evidence manifest SHA-256, and ledger seal. Below that, an itemized list of every element certified: signer identity verified, document exposure, acoustic challenge, head-turn liveness, signer physical presence, informed consent, lip motion, and verification pipeline.
PAGE FIVE — PLAIN-LANGUAGE SUMMARY
A version of the certificate written in everyday language for non-technical readers. Explains what was verified, when, and how anyone can check the record independently. This page is what a judge, a client, or a family member reads first.
PAGE SIX — VERIFICATION INSTRUCTIONS
How to verify the certificate’s digital signature in Adobe Acrobat Reader or Microsoft Edge. Contact information for the District Seal Verification Office.
The certificate is designed for court use. It can be presented to a judge, attached to a legal filing, or scanned by any third party for independent verification.
PART NINE: FEATURE SUMMARY
IDENTITY VERIFICATION
WebAuthn / FIDO2 hardware-backed device authentication.
Forced document scroll for informed consent.
Recorded verbal consent on camera.
Randomized spoken challenge phrase with speech-to-text verification.
Head-turn liveness detection with depth tracking.
Biometric face match against reference photo using ArcFace.
Duress channel (duress@districtseal.com) for coerced signers.
CRYPTOGRAPHIC
SHA-256 document binding.
Evidence manifest hash for the entire forensic record.
Ledger seal (short form) for verbal reference.
PDF digital signature that invalidates on any edit.
Public QR verification (no account required).
PRIVACY
Zero biometric media retention.
On-device processing for all biometric signals.
Reference photo retained 30 days, then destroyed.
No central server stores voice, video, or face data.
Designed for BIPA, CCPA, and EU AI Act compliance.
COMPLIANCE
ESIGN Act.
UETA (Uniform Electronic Transactions Act).
NIST 800–63–3 AAL2 (Authentication Assurance Level 2).
Remote Online Notarization (RON) supported in 49 US states.
OPERATIONS
Multi-user B2B accounts with unlimited team seats.
API access for platform integrations.
Signed outbound webhooks (HMAC-SHA256 with retry).
Public REST API with API key authentication.
Usage metering per ceremony.
Rate limiting on all public endpoints.
Full audit log of all account activity.
ACCOUNT SECURITY
Two-factor authentication (TOTP).
Password reset with email verification.
Session management with device fingerprints.
Forensic event log for admin actions.
REPORTING
Forensic timeline for every transaction.
Per-signal diagnostic values on every certificate.
Public verification page for any certificate.
Verification event tracking (who viewed which certificate, from which IP, country, city, device, browser).
Visitor analytics on the marketing site.
INTEGRATIONS
Paddle for billing (subscriptions and usage-based overage).
Resend for email delivery.
Cloudflare R2 for encrypted backups.
Playwright for PDF certificate generation.
MediaPipe for on-device face detection.
ArcFace for face recognition embedding.
Whisper for speech-to-text verification.
PART TEN: PRICING
District Seal has two pricing engines — one for individuals and small businesses, one for platforms and API customers.
CONSUMER ENGINE
Free tier: one signature, full ceremony, no card required.
Pay-as-you-go: $25 for 10 signature credits. Credits do not expire.
Pro: $29 per month. Unlimited signatures for one user, plus team features.
Firm: $99 per month. Unlimited signatures for the entire firm, with unlimited team seats.
Single signature: $2 per signature. For one-off high-value documents.
INFRASTRUCTURE ENGINE
API Starter: $250 per month. 200 signature ceremonies via API.
API Scale: $750 per month. 1,000 signature ceremonies via API.
Enterprise: custom pricing, custom ceremony configuration, dedicated support.
Overage pricing applies to API plans and is billed at the end of each calendar month through Paddle.
PART ELEVEN: THE FOUNDER
District Seal was built by Etonde Fael Synclair, a self-taught engineer from Mile 4, Limbe, Cameroon.
Synclair studied electrical engineering at Government Bilingual Technical High School, Isokolo, Limbe, and King Bilingual Community Comprehensive College, Mile 4. He earned his CAP — Certified Analytics Professional in Electrical Engineering — from Government Bilingual Technical High School, and later completed the GED (General Educational Development) as a US high school equivalency credential rather than a Cameroonian diploma. He also holds certificates in Data Science and Statistical Analysis from Programming Hub.
He was admitted to Coppin State University for Data Science, accepted, and committed to attend — then chose not to enroll during the Trump administration’s student deportation wave.
He built District Seal after watching a client lose a contract dispute over a signature that DocuSign could not prove.
His company, NEXSIM LLC, is registered in Montana, in the United States. It operates globally.
PART TWELVE: THE MARKET
The global digital identity verification market grew from $14.78 billion in 2025 to $17.33 billion in 2026 — a 17.2% CAGR. By 2030 it is projected to surpass $29 billion.
The forces driving that growth are the same forces that make District Seal necessary:
AI-generated identity fraud becoming indistinguishable from real identity at scale.
Remote Online Notarization legal in 49 US states.
Regulatory pressure from BIPA, CCPA, and the EU AI Act.
Court scrutiny of IP-address-only audit trails.
Juniper Research estimates 100.4 billion identity checks globally in 2026, up 16% from a year earlier. Every one of those checks is either a signature that holds up or one that does not.
PART THIRTEEN: WHAT IT IS NOT
District Seal is not a notary replacement. A notary is a state-commissioned officer. District Seal is a technological evidence layer.
It produces a forensic record of identity and consent that attaches to a notarial act or stands alone as evidence in a dispute. It proves who signed — not that they were legally authorized to sign.
It is not a document management system. It does not store signed contracts long-term. The signed PDF and certificate are delivered to the parties by email and stored on the customer’s own systems.
It is not a substitute for legal advice. The certificate is a forensic record. Whether that record is sufficient in a specific dispute is a question for the parties’ attorneys.
WHERE TO FIND IT
District Seal is a product of NEXSIM LLC.
The platform runs at districtseal.com. Verification of any issued certificate is available at verify.districtseal.com without an account.
For inquiries about onboarding high-value or high-dispute signing workflows, the Security Office can be reached via the contact page on the main site.
The founder, Etonde Fael Synclair, is available for interviews and product demonstrations.
Author: Etonde Fael Synclair — founder of NEXSIM LLC, creator of District Seal.
