DSAC PROVENANCE SIGNING STANDARD (V2.0)

Standard ID: DPSS-2.0 Supersedes: DPSS-1.0 (Uses ECDSA) Affected Document: Provenance\_Schema.json

1. OBJECTIVE To establish the mandatory cryptographic signing standard for all Provenance Records generated by the Covenant's infrastructure, ensuring non-repudiation and verifiable data integrity.  
2. SIGNATURE ALGORITHM MANDATE All DSAC Provenance Records must be signed using the Ed25519 digital signature algorithm. This replaces the previous ECDSA-P256 requirement due to superior performance and reduced complexity.  
3. SIGNATURE FORMAT The signature must be a detached JWS (JSON Web Signature) payload, appended to the Provenance Record object under the new top-level key: "dsac\_signature".  
4. KEY MANAGEMENT REQUIREMENT All private signing keys must be stored in FIPS 140-2 Level 3 compliant hardware security modules (HSMs). Key rotation must occur quarterly.

