Signed postsFor executives & creators4 min read

Why signed posts beat blue checkmarks

A badge proves the account is real. A signature proves you wrote the words. Those are not the same thing.

In 2015, the blue checkmark was enough. The pool of public figures was small, the platform's editorial team was big, and the cost of forging an identity was real human effort. None of those things are true anymore.

What a badge actually proves

Almost nothing. A verified badge tells you that at some point in the past, a moderation team agreed this account belongs to the person it claims to be. It tells you nothing about who wrote any specific post on that account.

If your account is hacked for thirty minutes, every post written in those thirty minutes wears your blue checkmark. If a screenshot of your account is doctored, the screenshot wears your blue checkmark too.

What a signature proves

A signed post carries a small block of text at the bottom — a fingerprint of the post, signed with a private key only you control. Anyone can run that fingerprint through a verifier and learn three things:

  1. Who signed it. Your domain. Your identity.
  2. What they signed. The exact words, not a paraphrase.
  3. When they signed it. A timestamp inside the signature itself.
Tampering becomes obvious
Change one comma in a signed post and the signature breaks. There's no graceful degradation — it's either valid or it isn't.

What changes when this is the norm

  • Hijacks become local. An attacker can post from your account but can't sign as you. The unsigned post is visibly suspicious.
  • Screenshots stop being evidence. A doctored screenshot has no signature to check. Real ones do.
  • AI rewrites become detectable. An LLM that "summarises" your post and reshares it can't replicate your signature. The original stands alone.
  • The press can quote you safely. Journalists paste your signed block into a verifier and know they're quoting the real thing, character-for-character.

What you do, concretely

Write your LinkedIn post in the QR studio. Click "Generate signed block". A small receipt appears underneath — copy it to the bottom of your post. That's it. People who don't care will scroll past it. People who care can verify in two clicks.

DKIM did this for email twenty years ago and nobody noticed. That's exactly the point.