Who is signing
A signature is entered with a personal signature PIN, separate from the login password, held only as a bcrypt hash. Five wrong attempts lock signing for fifteen minutes, and every failed attempt is recorded in the audit log. The signer's full name and, for mechanics, their certificate number are recorded with the signature.
