Gateways, connectors and open source.
How to connect providers, trusted lists and open components without lock in.
No signing platform does everything on its own. It needs providers that issue certificates and hold keys in custody, authorities that timestamp, trusted lists to validate against, identity services and, increasingly, open source components. The way it connects to all of that determines whether the platform can grow or stays tied to its first choices.
Gateway and connector: two different roles
- The connector knows how to talk to one specific third party: a provider, a timestamping authority, a trusted list. It translates between that party's protocol and the platform's internal language.
- The gateway sits above the connectors. It receives a general request, such as "validate this signature" or "get a timestamp," chooses which connectors to use, combines their responses and applies a policy.
The separation matters because it makes it possible to change or add connectors without touching the business logic, and to apply common rules, such as what to do when a third party does not respond, in a single place.
A trust gateway
Trust validation is a good example. A signature may come from a European, Uruguayan or Brazilian provider, and each appears on a different list. A trust gateway queries every enabled source and applies an explicit rule, for example: if any source says no, the answer is no; if any source says yes at the qualified level, the answer is yes at that level. The rule is written down and recorded, and it does not depend on which connector answered first.
Toward open source software
Many pieces of a good signing platform already exist as mature open source software: signature validation libraries maintained by public bodies, PDF conformance validators for archiving, document conversion tools, security event analysis engines. Integrating them has clear advantages.
- Verifiable trust. Anyone can review the code that performs validation.
- Less reinvention. Effort goes into what differentiates the product.
- Interoperability in fact. Using the same library others use reduces discrepancies.
- Responsibility toward licenses. Every open component has its license, and respecting it is part of the design.
Connectors talk to each third party; gateways decide whom to ask and how to combine the answers under an explicit policy. That separation allows growth without lock in, and the integration of mature open source software where it brings verifiable trust and interoperability, while respecting its licenses.