There are two layers:
Public data stored on-chain:
File hash (SHA-256)
Timestamp (issue date)
Algorithm used (e.g. SHA-256)
Encrypted metadata:
Includes full name, a legal declaration, email (hashed), and source (“emoz.io”)
Email is hashed first with SHA-256, then encrypted using XSalsa20-Poly1305 with a unique 32-byte key per certificate
Metadata is only decryptable with a secret seed stored in the user’s PDF certificate
This layered design guarantees privacy, even as computing power continues to advance.