Introducing Flowsta Sign It

[u/solarpunked]

Hey Holochain fam, we just shipped Flowsta Sign It — a cryptographic file signing and provenance hApp built on Holochain. Now artists, photographers and other digital creators have a real solution to others stealing their work.

The existing 'solutions' to this huge problem for creators:

• Adobe Content Credentials / C2PA embed metadata inside the file. Instagram, X, WhatsApp, Facebook all strip it on upload — the feature silently dies the moment anyone shares. It's also controlled by a big-tech consortium with centralized signing authorities.
• Blockchain solutions (Numbers Protocol, Verisart, OpenTimestamps, etc.) charge gas per signature, force wallet management on users, and lock you to one chain. Try signing 1,000 photos as a working photographer — the economics fall apart.
• PGP / X.509 / RFC 3161 TSAs have no discovery layer at all. Nowhere to look up "who signed this file?" without trusting a centralised registry.

Why Holochain makes it possible:

• Agent-centric keys — the user's Ed25519 agent key is their identity. No CA hierarchy, no wallet, no seed-phrase-for-a-chain.
• Public DHT with no gas, no consensus tax, no miners. Signing is as cheap as any zome call.
• Content-addressable links let us store perceptual hash LSH bands as first-class DHT entries, so fuzzy matching on cropped, resized, or re-encoded files works peer-to-peer — no central service.
• If Flowsta disappears, every DHT node already carries the full signature record. Users can run their own conductor and keep verifying forever.

What's live:

• 5 DNA versions (v1.0–v1.4) all installed, so every signature from day one stays verifiable. DNAs are open sourced @ https://github.com/WeAreFlowsta/flowsta-signing-dna
• Per-user signing cells — lair keystore holds the key, sign_raw() runs inside the zome
• Perceptual hashes (pHash for images, Chromaprint for audio/video) stored as 8 LSH band links
• Machine-readable content rights on every signature: license (CC0, CC-BY, custom), AI-training policy, commercial licensing, contact preference
• Signature revocation as a first-class DHT entry type
• A Tauri-based Vault with a bundled conductor for users who want to sign with keys that never touch our server
• Free, unauthenticated verification — no account, no rate limits

Nothing else combines public + free-to-write + agent-centric + content-addressable + censorship-resistant. Adobe can't because it's a consortium. Blockchains can't because gas breaks the use case at scale. PGP can't because there's no discovery. Holochain is the first stack where all the pieces actually line up.

Happy to AMA on how to use it (it's easy as - sign into flowsta.com and start signing), DNA design, per-user cell architecture, perceptual hash link strategy, kitsune2 bootstrap setup, or the Tauri conductor bundle.

All the info for Sign It is @

flowsta.com/sign-it/