GOVP vs — and when not GOVP.
Every technology here is good at something. This page says plainly what each one proves, where GOVP composes with it, and — because credibility is built on limits — when GOVP is the wrong tool.
Electronic signatures (PAdES / XAdES / personal eIDAS)
A person or legal entity signed a document, backed by a certificate chain and a trust-service provider. Strong legal standing for human signatures; verification depends on PKI infrastructure and certificate validity at signing time.
An operational declaration is bound to a domain identity with a content-derived ID, published at .well-known, and verifiable offline from the record alone — no CA chain to resolve, decades later.
Blockchains
Global ordering of transactions without a trusted anchor, at the cost of consensus infrastructure, tokens or fees, and everyone holding (or trusting someone who holds) the chain.
Per-record integrity and authorship with zero shared infrastructure: a record is a file that verifies anywhere. Ordering, when needed, comes from RFC 3161/QTSP anchors or independent witnesses — pay for ordering only where you need it.
A bare RFC 3161 timestamp
That some hash existed at a point in time, per an independent TSA. It says nothing about who declared what, under which identity, or how to discover and re-verify the artifact years later.
The full declaration: publisher, domain binding, content-derived ID, self-contained verification — with RFC 3161 available as the GOVP-RFC3161 profile when the time itself must be provable.
C2PA / Content Credentials
Media provenance: how an image or video was captured and edited, attested along the creative toolchain, sometimes down to camera hardware. Purpose-built for media authenticity.
Operational declarations about any asset — a steel lot, a control review, a dataset, a release — bound to the organization's domain rather than to a media toolchain.
in-toto / supply-chain attestations
That each step of a software supply chain ran as laid out, with signed attestations per step. The gold standard for build pipelines.
Treats in-toto attestations as a source type: verified by their own rules, checked against an anchor registry, then counted — alongside sensors, calibrations and human approvals — toward an independence-weighted conclusion.
When GOVP is the wrong tool
- ✕You need to prove the content is true. GOVP proves integrity and authorship — never physical truth. Truth needs audits, testing or formal evaluation on top.
- ✕You need secrecy. GOVP evidence is built to be public and CORS-open. Confidential material belongs elsewhere (fix only its hash if you must).
- ✕You need global ordering with no anchors at all. That is a blockchain's home turf, with its costs.
- ✕You need a person's legal signature. Use a qualified personal signature; wrap the operational record around it with GOVP if useful.
- ✕You need provable time but refuse anchoring. Under GOVP-BASIC the date is issuer-asserted. If backdating matters and you won't use RFC 3161/QTSP or witnesses, GOVP cannot help you — and says so.