Should open CAD repositories sign safety-relevant files?

I print replacement parts often, and I’m wondering whether open CAD repositories should support cryptographically signed, versioned files for things like brackets, enclosures, and appliance repairs.

A signature could at least tell me that the geometry I downloaded matches a named revision, rather than a silently modified or malicious substitute. That seems useful. But it could also create false confidence: printer settings, material, orientation, layer bonding, and post-processing still determine a lot of the result. A “Verified” badge cannot make a weak print safe.

Would a lightweight hash, author identity, changelog, and reported print conditions be enough? Or would signing gradually centralize authority over community designs? I’d like examples of tampered files, near-miss failures, or better ways to establish trust in distributed fabrication.

The useful security property is narrow: detect changes after signing and identify the intended revision. It does not establish that the signer inspected the load path, used the right material, or tested the part. I’d support signatures if the interface makes that limitation impossible to miss.

I’d separate “who published this?” from “does this work?” A signed tag can support the first question, while test notes and reproducible print conditions address the second. Combining them into one green trust mark would be the dangerous product decision.

Hashes plus an append-only change history solve most of the substitution problem without inventing a priesthood of approved designers. Signing is still worthwhile, but only as metadata. The repository should show the diff between revisions, not just a padlock.

Most users will read a badge as “safe,” regardless of the tooltip. If signing ships, the UI needs separate labels for identity, unchanged bytes, and community test evidence. Three modest signals are better than one reassuring seal.

The 3MF Core Specification already allows optional digital signatures through its packaging model. That makes the mechanism less hypothetical, but it doesn’t answer the social question: who signs, and what exactly are users supposed to infer from the signature?

Trust is partly an interface problem. Put the revision, author, changes, material, orientation, and failure reports beside the download button. Burying all of that under “verified” teaches people the wrong mental model.

A signed bad bracket is still a bad bracket. I’d take a visible history and boring test notes over a ceremonial cryptographic seal, especially for community files.

There’s also a key-management problem, even before authority enters the picture. If a contributor loses a key or changes identity, the history needs a way to explain that without rewriting the past. Otherwise verification becomes another opaque account badge.

Reported print conditions would help more than people expect, though they’ll never cover every machine. At minimum I’d want orientation, material family, nozzle or layer assumptions, and any post-processing called out as part of the revision notes.

I’d prefer signed manifests that can travel with the files and remain verifiable after a repository disappears. Central hosting can add convenience, but it shouldn’t be the only place where provenance works.

The centralization concern is real, but unsigned history has its own weakness: anyone can copy a popular design and present it as the original. A signature gives maintainers and users one more piece of evidence. It need not become an approval system.

Please don’t make the printer refuse unsigned parts. That turns a useful integrity check into a brittle gate and guarantees workarounds. Warn, show the revision chain, and let the operator decide.

For appliance repairs, provenance may matter to a cautious buyer, but procurement-style approval language would overwhelm ordinary makers. A compact record of author, revision, material, and known failures seems like the practical layer.

I haven’t encountered a verified public catalog of tampered CAD files, so I’d be wary of designing around anecdotes. Still, silent geometry changes are a plausible threat, and cheap integrity checks seem preferable to pretending the threat is impossible.