VerifiedSigner

Who a valid signature established. The fingerprint is the identity; the uid is how a human recognises it. They are kept apart because only one of them is a fact: a key can carry any uid its holder typed when creating it, while the fingerprint is derived from the key material and cannot be chosen to impersonate another. So the fingerprint is what an audit line is keyed on, and the uid is what it displays. This is the same distinction that ran through the whole surface — established against claimed — arriving at the place where it costs nothing to get right and everything to get wrong.

public function __construct(string $fingerprint, ?string $uid = null):

Parameters

public function principal(): string

What the audit log records as the actor. Fingerprint first, because that is the part a verifier can act on months later; the uid rides along in parentheses for whoever is reading rather than querying.