We signed the same thing twice to see if the ink matched
A small story with a moral.
The signature scheme our public log has always used, Ed25519, has an underrated property: it is deterministic. Sign the same message with the same key on Tuesday and again in ten years, and you get the identical signature — not a similar one, the same bytes.
That makes a lovely audit possible. Our log's latest published page was signed weeks ago. So we asked: if we re-run the signing today, from the key in storage, over the payload as we reconstruct it — do we get exactly the published bytes?
We did. Byte for byte. Which quietly proves three things at once: the key in storage is really the key that signed; our reconstruction of "what got signed" hasn't drifted; and the whole signing path still behaves as it did. One comparison, three audits.
And here is the moral: the exercise caught a bug anyway. The re-signing came back correct but reported it had used a different implementation than the published record claimed — our fallback library instead of the one from our proof-attested family. The cause was almost embarrassing: the code located the attested signer (whose proofs cover checking, not making, signatures) by a relative path, so which cryptographic implementation signed our log depended on which directory you happened to launch from. Because both implementations produce identical bytes (determinism again), no output ever differed, no test ever failed, and nobody could have noticed — until an exercise demanded the process be reproducible, not just the result.
Fixed the same day: the path is now anchored, and there's a switch that refuses to sign at all rather than silently substitute. When we later added a second, post-quantum signature to the log, we chose its deterministic variant for exactly this reason — an artifact you can re-derive byte for byte is an artifact that can testify.
Reproducibility isn't bureaucracy. It's the only witness that was in the room the whole time.