- Shipped
- September 9, 2026 at 10:57 PM UTC
- Author
- Kamo
- Commit
- c00e767
`buildSession` reported `stepUpRequired ? "AES" : "SES"`, so requiring a one-time passcode made every signing session assert an ADVANCED electronic signature — on the wire, to whoever reads it. eIDAS Article 26 lets a signature call itself advanced only if all four of its conditions hold, and (c) is the one this product cannot meet: the signature creation data must be something the signatory uses "with a high level of confidence, under their sole control". A link emailed to an address, plus a passcode read out of that same mailbox, is an authentication factor. It is not signature creation data, there is no key only the signer holds, and calling the result advanced claims a legal tier nobody implemented. It reports SES, always. Nothing is lost by saying so: the certificate of completion states the authentication method in words — "Single-use link emailed to … + one-time passcode verified (EMAIL)" — which is both truthful and more use to a reader than a three-letter tier. Under E-SIGN and UETA, which have no tiers at all and are the law most of these signatures are given under, a simple electronic signature is fully effective. AES stays in the type for the day a signer holds their own key. Pinned by a test, because it is a legal claim and the obvious way for it to come back is somebody reasoning "we added 2FA, so it's advanced now".