Signing with your own certificate

Your certificate proves you hold a key. It does not prove who you are
until we have enrolled it against your name.

So enrol it once, from your own account, before you are asked to sign
anything with it. A signature from a certificate nobody enrolled is
refused, however good the signature is.

Enrolling

Go to My signing keys and add the certificate. You paste the
certificate itself, never the private key. LEAT never asks for a private
key, and any page that does is not LEAT.

Enrolling grants you nothing. What you are allowed to approve comes from
the scheme of delegation, separately. Somebody can hold a certificate and
be allowed to approve nothing at all.

Signing

When you are asked to decide, LEAT gives you a short document to sign. It
names the thing being approved, the exact version, and your decision. You
sign that document with your own software and send back the signature.

You cannot sign something else and have it accepted. The document is
generated by LEAT for that one decision, and the signature is checked
against it.

Three answers, not two

A certificate signature comes back as one of three things, and the middle
one is the one people find surprising.

• Accepted. The signature matches, the certificate chains to an authority we trust, it was inside its validity window, and it was not on the revocation list.
• Rejected. The signature does not match the document, or the certificate is from an authority we do not trust, or it has expired, or it has been revoked. Your decision is not recorded.
• Could not be checked. The signature is fine and something we needed was not available: usually the revocation list. Your decision is also not recorded, and somebody has to establish the missing piece.

The third is not a softer version of the second. It means nobody can say
either way, and treating it as a pass would be recording an approval we
never verified.

If your certificate is replaced or compromised

Withdraw the old one from My signing keys and enrol the new one.
Decisions you already made with the old certificate stay on the record:
withdrawing it stops it being used again, and changes nothing about what
it already signed.