feat: add cryptographic signature support to all lexicons

Add optional cryptographic signature support to all record lexicons, enabling
platform attestation and verification that records were created through
trusted services.

Inspired by:
- ATProtocol Attestation Specification by Nick Gerakines
- The platformAttestation pattern from app.bumicerts.link.evm

New lexicons:
- app.certified.signature.inline: Inline signature with JOSE algorithm IDs
- app.certified.signature.list: Container with signatures array (open union)
- app.certified.signature.proof: Remote attestation proof record

All 20 record lexicons now include an optional signatureData property:
- org.hypercerts.claim.* (activity, contribution, contributorInformation, rights)
- org.hypercerts.collection
- org.hypercerts.context.* (acknowledgement, attachment, evaluation, measurement)
- org.hypercerts.funding.receipt
- org.hypercerts.workscope.tag
- org.hyperboards.* (board, displayProfile)
- app.certified.badge.* (award, definition, response)
- app.certified.actor.* (profile, organization)
- app.certified.location
- app.certified.link.evm

Design decisions:
- Uses ref to app.certified.signature.list for DRY structure
- JOSE algorithm identifiers (ES256K, ES256, Ed25519) per ATProto convention
- Supports both inline signatures and remote attestations via strongRef

Author: satyam-mishra-pce

.changeset/fuzzy-pandas-smile.md

@@ -0,0 +1,50 @@
+---
+"@hypercerts-org/lexicon": minor
+---
+
+Add cryptographic signature support to all lexicons
+
+Adds optional cryptographic signature support to all record lexicons, enabling platform attestation and verification that records were created through trusted services. This is inspired by the [ATProtocol Attestation Specification](https://ngerakines.leaflet.pub/3m3idxul5hc2r) by Nick Gerakines.
+
+**New lexicons:**
+
+- `app.certified.signature.inline` - Inline cryptographic signature object with JOSE algorithm identifiers (ES256, ES256K, Ed25519)
+- `app.certified.signature.list` - Container object with `signatures` array supporting both inline signatures and remote attestation references
+- `app.certified.signature.proof` - Remote attestation proof record containing the CID of attested content
+
+**Changes to existing lexicons:**
+
+All 19 record lexicons now include an optional `signatureData` property that references `app.certified.signature.list`:
+
+- `org.hypercerts.claim.activity`
+- `org.hypercerts.claim.contribution`
+- `org.hypercerts.claim.contributorInformation`
+- `org.hypercerts.claim.rights`
+- `org.hypercerts.collection`
+- `org.hypercerts.context.acknowledgement`
+- `org.hypercerts.context.attachment`
+- `org.hypercerts.context.evaluation`
+- `org.hypercerts.context.measurement`
+- `org.hypercerts.funding.receipt`
+- `org.hypercerts.workscope.tag`
+- `org.hyperboards.board`
+- `org.hyperboards.displayProfile`
+- `app.certified.badge.award`
+- `app.certified.badge.definition`
+- `app.certified.badge.response`
+- `app.certified.actor.profile`
+- `app.certified.actor.organization`
+- `app.certified.location`
+
+**Design notes:**
+
+This is a non-breaking extension - signatures are optional on all records. Two signature patterns are supported:
+
+1. **Inline signatures** - Embedded directly in the record via `app.certified.signature.inline`
+2. **Remote attestations** - References to proof records in other repositories via `com.atproto.repo.strongRef`
+
+Signature algorithm identifiers use [JOSE format](https://www.iana.org/assignments/jose/jose.xhtml) per ATProto convention:
+
+- `ES256K` - secp256k1 (Ethereum/Bitcoin curve, ATProto default)
+- `ES256` - P-256 (NIST curve, WebCrypto compatible)
+- `Ed25519` - EdDSA

README.md

@@ -44,6 +44,9 @@ CERTIFIED ─ shared lexicons (certified.app)
   actor/profile             (user profile)
   actor/organization        (org metadata)
   badge/definition ──► badge/award ──► badge/response
+  signature/inline          (embedded cryptographic signature)
+  signature/list            (container for signatures array)
+  signature/proof           (remote attestation proof record)
 ```
 
 Every arrow (`►`) is a `strongRef` or union reference stored on the
@@ -149,6 +152,16 @@ await agent.api.com.atproto.repo.createRecord({
 | **Badge Response**   | `app.certified.badge.response`     | Recipient accepts or rejects a badge award.                                                                                     |
 | **EVM Link**         | `app.certified.link.evm`           | Verifiable ATProto DID ↔ EVM wallet link via EIP-712 signature. Extensible for future proof methods (e.g. ERC-1271, ERC-6492). |
 
+### Signatures (`app.certified.signature.*`)
+
+| Lexicon              | NSID                             | Description                                                                                                                                     |
+| -------------------- | -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Inline Signature** | `app.certified.signature.inline` | An inline cryptographic signature for attesting to record content. Uses JOSE algorithm identifiers (ES256, ES256K, Ed25519).                    |
+| **Signature List**   | `app.certified.signature.list`   | Container object with a `signatures` array. Referenced by all record lexicons via `signatureData` property.                                     |
+| **Proof**            | `app.certified.signature.proof`  | Remote attestation proof record containing the CID of attested content. Lives in the attestor's repository and can be referenced via strongRef. |
+
+All record lexicons include an optional `signatureData` property that references `app.certified.signature.list`, enabling cryptographic attestations. See [Cryptographic Signatures](#cryptographic-signatures) for usage details.
+
 > **Full property tables** → [SCHEMAS.md](SCHEMAS.md)
 
 ## Entity Relationship Diagram
@@ -368,6 +381,73 @@ const attachment = {
 };
 ```
 
+### Cryptographic Signatures
+
+All record lexicons support optional cryptographic signatures via the `signatureData` property. This enables platform attestation and verification that records were created through trusted services.
+
+Signatures support two patterns:
+
+1. **Inline signatures**: Embedded directly in the record
+2. **Remote attestations**: References to proof records in other repositories (via `strongRef`)
+
+```typescript
+import { ACTIVITY_NSID } from "@hypercerts-org/lexicon";
+
+// Activity with inline signature
+const signedActivity = {
+  $type: ACTIVITY_NSID,
+  title: "Verified Reforestation Project",
+  shortDescription: "Planted 1,000 trees in partnership with local community",
+  createdAt: new Date().toISOString(),
+  signatureData: {
+    signatures: [
+      // Inline signature (embedded)
+      {
+        $type: "app.certified.signature.inline",
+        signatureType: "ES256K", // JOSE algorithm: secp256k1
+        signature: new Uint8Array([
+          /* signature bytes */
+        ]),
+        key: "did:plc:platform123#signing", // DID verification method
+      },
+      // Remote attestation (reference to proof in another repo)
+      {
+        $type: "com.atproto.repo.strongRef",
+        uri: "at://did:plc:verifier/app.certified.signature.proof/abc123",
+        cid: "bafy...",
+      },
+    ],
+  },
+};
+```
+
+#### Signature Algorithm Identifiers
+
+The `signatureType` property uses [JOSE algorithm identifiers](https://www.iana.org/assignments/jose/jose.xhtml):
+
+| Value     | Curve     | Description                             |
+| --------- | --------- | --------------------------------------- |
+| `ES256`   | P-256     | NIST curve, WebCrypto compatible        |
+| `ES256K`  | secp256k1 | Ethereum/Bitcoin curve, ATProto default |
+| `Ed25519` | Ed25519   | EdDSA, increasingly popular             |
+
+#### Remote Attestation Proofs
+
+For remote attestations, create a proof record in the attestor's repository:
+
+```typescript
+import { SIGNATURE_PROOF_NSID } from "@hypercerts-org/lexicon";
+
+const proof = {
+  $type: SIGNATURE_PROOF_NSID,
+  cid: "bafy...", // CID of the attested content
+  note: "Verified by platform quality assurance process",
+  createdAt: new Date().toISOString(),
+};
+```
+
+For the full specification, see Nick Gerakines' [ATProtocol Attestation Specification](https://ngerakines.leaflet.pub/3m3idxul5hc2r).
+
 ## Development
 
 ### Commands