Why the Sigilbase mark is made of brass

The Sigilbase mark now exists as an object. It is a 25mm brass die, cut in London by The Little Blue Brush, and the mark is the impression it leaves in wax.

How it was made

The S is Libre Caslon Text Bold, an openly licensed revival of William Caslon's type, and the same family this site is set in.

Engraving puts a floor under stroke width. Caslon's hairlines are fine by design, and below a certain width a stroke is not cut at all. We measured the thinnest strokes of the S at several sizes and set it at a 15mm cap height, the smallest at which they stay wide enough to engrave cleanly. A single ring surrounds it, 0.8mm wide at 23mm across, on a 25mm face.

Dies are cut in mirror, so on the brass the S reads backwards.

Why a seal

A wax seal did two jobs. The impression said who sent the letter, because only the sender held the die. The wax said whether anyone had opened it, because nobody could get in without breaking it. The seal never stopped anyone reading the letter. It made the reading show.

Sigilbase does the same for audit records, in different materials. Each checkpoint is signed with our key, which says who sealed it, and each event is hash-chained to the one before, so any later change breaks the chain at the exact record. Neither step prevents tampering. Both make it show, which is the difference between tamper-evident and tamper-proof, and the subject of what tamper-evident logs are and why they matter.

The analogy holds for the limits too, which matter more to us. A seal tells you nobody opened the letter, and nothing about whether the letter is true. A Sigilbase record proves it has not changed since we received it, and nothing about whether it was accurate when it arrived. We say the second part wherever we say the first.

The name was already pointing here. Sigil comes from the Latin sigillum, a seal.

Why analogue

The cryptography behind Sigilbase is standard on purpose. Standard constructions are the ones reviewers already trust, and the verifier is open so anyone can check how we use them. The consequence is that the words for what we do, tamper-evident and verifiable offline, are shared across the category. Anyone can put them on a homepage.

An object is harder to share. A die takes a maker and a week to cut, and nobody gets one by editing a page.

There is a plainer reason as well. The people we most want to reach are assessors, who read evidence for a living and receive a great deal of email. Very little of their post arrives sealed.

The letters

Letters are going out to UK assessors, and each is sealed twice. The first seal is wax, pressed with the die above. The second is the letter itself, sealed into the Sigilbase ledger before it is posted.

Each letter comes with a small record card carrying its number and a private link, where the holder can check that the letter in their hand is the one we sealed. The ledger holds only the letter's fingerprint, which reveals nothing about who it went to or what it says.

The second seal is there because the first can be beaten. Wax can be lifted with a warm blade and pressed back by someone patient enough, and for centuries people did exactly that. Nobody lifts a hash with a knife.

The limit applies here as well. Checking the letter proves it has not changed since we sealed it. Whether its argument holds is for the reader to judge.

If one reaches you, break the wax. That is what it is for.