QR verification on signed reports: how the trust chain actually works
The QR code on the last page of a signed report is not decoration — it is a public verification endpoint. Here is what it proves and what it does not.
Every finalized GARAASSETS report carries a QR code on the signature page. Scanning it opens a public verification page that shows: the expert's name and license, the case reference, the SHA-256 hash of the signed PDF, the signing timestamp, and whether the document has been revoked.
What this proves: the file the reader holds is byte-for-byte the file the expert signed, and the person who signed is who they say they are. This is legally equivalent to a wet signature in Israel, the EU, the UK, and the GCC under the respective electronic signature acts.
What it does not prove: that the content of the opinion is correct, that the expert is licensed for this specific case type, or that the client has paid. Verification is authenticity, not endorsement.
The trust chain: the private signing key never leaves the expert's tenant. The public key is published at /verify. The QR encodes the case hash and the verification URL. Anyone with a phone can verify in three seconds without a login. GARAASSETS never sees or stores the private key.