The Sigsum team is happy to announce a first release of the sign-if-logged tool. This program lets you use a TKey security key to create signatures only on data that has already been Sigsum logged according to a configured policy, using a signing key tied to both the policy and the device. This is intended to enable transparency for signatures verified by systems that are unlikely to support and enforce transparency logging directly, due to limited performance, or adherence to other standards. See the README file https://git.glasklar.is/sigsum/apps/sign-if-logged/-/blob/main/README.md for more information. The source code for the release can be checked out using git clone -b v1.0.0 https://git.glasklar.is/sigsum/apps/sign-if-logged.git or installed using go install sigsum.org/sign-if-logged/cmd/sign-if-logged@v1.0.0 The v1.0.0 tag is signed using the key ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ/xZ+v5e435605MS4BYE89PLcgk8DT5PvuoM2oASnuk This is the same release key also published for nisse@glasklarteknik.se at https://www.system-transparency.org/keys/allowed-ST-release-signers. The release bundles a precompiled TKey app corresponding to version 1.0.0 of tkey-sign-if-logged. It can be reproduced by running make -C build-device-app The source code of the TKey app can also be checked out using git clone -b v1.0.0 https://git.glasklar.is/sigsum/apps/tkey-sign-if-logged.git /The Sigsum team NEWS for the sign-if-logged v1.0.0 release This is the initial release of the sign-if-logged program. It is used together with the corresponding TKey device app https://git.glasklar.is/sigsum/apps/tkey-sign-if-logged, and a precompiled device app is bundled with this program. This version supports Ed25519, and ECDSA over the Secp256r1 curve. For each curve, one can configure either raw signatures or OpenSSH-style signatures, and if device touch should be required when signing.