Attested data

Data is a response to a request for information. The problem with consuming it is not usually availability, it is knowing who produced it. Humans lean on the reputation of the source, and the failure mode is trusting the wrong one.

Why the source signs

The best way to consume information is directly from the source. Api3 coined the term first-party oracle for exactly this. But first-party data is not composable: X telling you that Y recommended a cafe is not the same as Y recommending it, and checking the difference means going back to Y. Retrospective fact-checking does not scale.

The fix is that the data carries the attestation itself. Any response can be encoded as bytes, and a signature over its hash lets any consumer verify who produced it, using only the signer's public key. A reputable intermediary signing is worth something, but the source signing is worth the most, because it is the only signature that attests to producing the data rather than to passing it along.

Why it composes

Given data D1, D2 and D3 with signatures sD1, sD2 and sD3, an aggregate D4 is:

D4 = D1|sD1|D2|sD2|D3|sD3|AGG

| is a separator that appears in none of the messages, and AGG is the new information derived from the sources. Signing D4 produces sD4. A consumer holding D4 and sD4 can verify every underlying source and confirm the aggregation was not invented along the way.

This matters most when an agent composes an answer from several APIs. Every unattested hop is a place where provenance is lost. Signed data preserves the chain, and the provider is identifiable in the result rather than erased by it.

Where this is proven

None of it is hypothetical. Api3 oracles already run on this principle: API providers are paid to maintain a signed version of their API, and the resulting data feeds aggregate values that can each be attributed back to the provider that produced them. It secures real value in production today. What has been missing is a market for it beyond oracles.