Your documents are being forged in your name.

The cost you're already paying

• Brand damage you don't control. When PPE Medpro supplied the NHS against a test report bearing Intertek's name — a report Intertek never issued — the forgery sat undetected through 72 shipments. Courts later ordered £122m repaid, but the goods were already landfill. The fake was checkable in principle from day one; there was just no way to check it.
• A verification call centre you never wanted. Employers, landlords, embassies, and procurement teams email and phone you to ask "did you really issue this?" — a manual workload that scales with your success.
• No way to revoke. A paper certificate you issued in 2019 to someone since struck off looks exactly as valid as one issued yesterday.

What adopting looks like (smaller than you think)

You add one footer line to documents you issue:

And you publish a SHA-256 hash of each document's text at that URL on your own domain. Static file hosting is enough — a hash lookup is a plain HTTPS GET. No login system, no API platform, no blockchain, no per-verification fees, no vendor.

Anyone — an employer, a border officer, a procurement clerk — selects the text on screen or points a phone camera at the paper, and in about four seconds learns whether you stand behind it right now. Change the status file and it's revoked everywhere, instantly.

Effort estimate: a sprint, not a migration. The pipeline is text → normalize → SHA-256 → publish. Reference implementations, normalization rules, and cross-platform test fixtures are all Apache-2.0 on GitHub. A small engineering team can pilot with one document class in one to two weeks.

Your back catalog counts too

You don't need to wait for the next issuance cycle. Any record you already hold — degrees granted in 2020, licences still in force, certificates still active — can be made verifiable retrospectively: reconstruct the claim text from your system of record, hash it, publish. Start with the 100,000 records people keep asking you to verify, and the manual verification workload starts falling immediately.

What you are not signing up for

• No PII leaves your systems. You publish one-way hashes, not document contents. The plaintext stays in your private systems; the public tier holds only hash → status.
• No vendor, no fees, no lock-in. This is an open standard (Apache 2.0), like email or RSS. Adopt without permission; stop whenever you like — delete the files and you're out.
• No change to how documents look. One footer line. No QR codes, special ink, NFC chips, or new hardware for you or for verifiers.
• No central registry. Your hashes live on your domain, under your control and your jurisdiction. Nobody — including this project — sees who verifies what.

Be a founding issuer

The first ten pilot issuers get free advisory support from the standard's author — design review of canonical text templates, normalization fixtures, endpoint setup, and revocation workflow, by email, up to a sensible advice limit — in exchange for being nameable as an early adopter. Sustained implementation work is beyond the free scope and can be referred to commercial integration partners. Founding issuers are listed permanently on the founding adopters page.