Compliance

Two signatures, and why one of them has to be independent

Dual attestation is easy to implement in a way that provides no additional assurance at all.

June 10, 2026  ·  The Renny team

Requiring both the contractor and the homeowner to confirm completion before a draw is funded is now common practice. It is also commonly implemented in a way that adds a field to a record without adding a source of truth.

The implementations that add nothing

• The contractor collects the borrower's signature on the contractor's device, in the contractor's session.
• The borrower's approval is a checkbox the contractor can tick on their behalf "because they said it was fine".
• The signer's identity comes from a form field rather than from an authenticated session, so any value can be submitted.
• Both parties sign the same document, but the document is one the contractor assembled and can still amend.

In each case the file ends up with two signatures and one source. The second signature is decorative.

What makes the second signature load-bearing

Three properties, and all three are necessary:

• The signer comes from the session. Never from the request. If there is a parameter that names who is signing, then somebody can set it, and eventually somebody will.
• The document is frozen and fingerprinted. Recorded at the moment of signature, so what each party saw is provable rather than inferred from what the record says now.
• The signatures are independent. Each party authenticates separately, on their own device, in their own session. Not sequenced through one device held by one of them.

If a parameter names the signer, the signature is an assertion. If the session names the signer, it is evidence.

The practical objection, and the answer

Contractors will say some borrowers are elderly, or offline, or simply will not engage with an app, and that a rigid requirement will strand real jobs. That is a genuine problem and it deserves a designed answer rather than a waiver.

The answer is alternative authenticated channels for the borrower — not a bypass that lets the contractor sign for them. The moment a bypass exists, it becomes the default path for the cases where independence mattered most.