A jurisdiction-neutral proof grade, with legal recognition stated beside it

The problem

The scale was built around the EU, and today the letter mixes two different things: how strongly the file proves who signed it and that it has not changed, and whether that proof carries legal status in the EU. Inside the EU the two mostly coincide. Outside it they separate, and the letter stops saying what it claims to measure:

• A qualified signature under Switzerland’s ZertES or the UK’s qualified regime (real supervision, real conformity assessment, a certified signature device) is capped at B, the same letter as an advanced seal on a qualified certificate in the EU.
• A well-built signature from a provider on an established commercial trust list, the de facto anchor in markets without a national list such as the United States, is capped at B however it is built.
• A statutory, supervised national scheme whose own list is not carried, for example Brazil’s ICP-Brasil, is recognised only where one of its roots happens to be on an established commercial trust list, and is then capped at B by a commercial programme. A certificate under a root no such list has admitted falls to D, “unprovable signer”.

For a reader in São Paulo, Zürich or Chicago, a B or a D reads as “weak evidence” when it actually means “not EU”. The scale’s own definition (how strongly the file proves, on its own, who signed it and that it has not changed) and its disclaimer that the grade measures verifiability rather than legal validity both point the other way.

The proposal: two parts, always shown together

Part 1: a jurisdiction-neutral proof grade

The same ladder as today, with one change: the trust gate asks about the assurance level of the issuing service, not whether it sits on the EU list.

Part 2: legal recognition, stated per regime

Next to the letter, never inside it. For example: “Qualified electronic seal under eIDAS (EU)”, “Qualified electronic signature under ZertES (Switzerland)” or “No statutory recognition”. The rubric already requires a grade never to appear without the trust regime that vouched for it; this makes that rule carry the legal information explicitly.

The line states only what the trusted list data itself records: the regime the certificate belongs to, and a recognition that is part of that data, such as an eIDAS Article 14 agreement. How other jurisdictions treat a regime is a legal assessment outside the standard, not part of the grade.

Criteria for admitting a national scheme as statutory qualified

1. A statute that defines a qualified or accredited status for signatures or seals.
2. Independent conformity assessment of the providers, and a named supervisory body.
3. Key protection equivalent to a qualified signature creation device.
4. A published trusted list, or an authenticated equivalent, that a validator can load and verify against the operator’s pinned signing certificate. An unauthenticated list is not a trust source.

Whether a given scheme meets these criteria is partly a legal assessment. Each admission would be reviewed before it is made and recorded in the changelog of the version that adds it.

Effect on grades

The same technically identical document (intact, B-LTA, qualified archive timestamp, whole document covered) under five different trust anchors:

No document’s letter goes down under this proposal; some go up. Under the scale’s versioning rules that makes it a minor change, and it belongs before version 1.0, after which published versions are fixed.

If DTG-P2 is adopted as well, the letters here map one to one: A+ becomes AAA, B becomes A and D becomes BB.

Questions for commenters

1. The split. Is a jurisdiction-neutral proof grade with a separate legal recognition line the right model for the documents you see, or would relying parties rather have one grade per jurisdiction?
2. Priority regimes. Outside the EU, which national signature schemes do you actually encounter, and which should be admitted first?
3. Admission criteria. Are the four criteria too strict, too loose, or missing something?
4. What relying parties act on. In your market, does a recipient decide on the letter, on the legal line, or on both? Is the regime a document belongs to enough, or do recipients also need to know how their own jurisdiction treats it?