Support digital signature/timestamps on dataset versions

Overview of the Feature Request
Odum is interested in developing the ability to digitally sign a dataset version (i.e. during a pre-publication workflow) so that it is possible to prove that the dataset version has not changed since the signing. The current plan is to leverage a separate application for this, i.e. one that would use an institutional signing/timestamp authority but doing this would still require some modifications to Dataverse. The proposed changes at this point would be:

• Allow OAI-ORE/any export to be requested for any dataset version, including drafts (access to this last one would have to be authorized and would not be cached). This would allow the OAI-ORE to be used in the content being signed in a pre-pub workflow and for regeneration of the OAI-ORE file for earlier versions for use in validation efforts.
• Create a place, perhaps an column in the dataverse table for a signature to be stored (probably json), perhaps as a separate (aux?) file. When a signature exists, it would be added to the OAI-ORE export (and archival Bags) in an element clearly separate from the dataset contents (i.e. avoiding the catch 22 of signing something (a dataset description) that includes the signature itself)
• Explore use of the new (in review) signedURL capabilities to be able to provide a signer/validator app with only read-only access to the dataset contents.

While the overall development is in its early stages and details may change, the expectation is that these changes in Dataverse could/should be generally applicable for signing applications and perhaps valuable in other use cases as well.

What kind of user is the feature intended for?
Regulated environments where being able to detect malicious changes (in addition to accidental changes) is important.

If anyone else interested in this and/or working on something similar, please get in touch.