Sealed with a dual BLAKE3 + SHA-256 hash and a signed provenance record.
Master fingerprints. Each delivered copy is signed individually and carries the master hash inside its signed record.