The witness
Servers countersign events at ingest: “I saw hash H at time T.” Trusted signing time is the load-bearing input for “actor held role R at signing time” and the moment a stage’s social meaning solidifies.
witnessed.dev productizes this as a neutral third-party witness: countersigning event hashes only (no content leaves the organization), giving self-hosted instances independent timestamping evidence for audits.