Each item is hashed, and that hash — with its title, source and timestamp — is signed with the demo key. The signature and a registry entry are the output.
Check an untouched copy, a tampered copy, or something that was never signed.
Nothing leaves this machine. The file is read locally, hashed, and signed with the same demo key.
The limits matter as much as the capability. Stated plainly, because an evaluator deserves it.
An append-only, hash-chained log. Each entry carries the hash of the one before it, so removing or editing history breaks the chain.