Let a deterministic verifier check signatures and record hashes; let the LLM explain the result. Report separately: signature valid, signing key recognized, and approval chain accepted under this instance's policy. A valid signature proves that a key signed these bytes; it does not establish that the claims are true.