[Disclosure: I work for CoSign]
You will need to write software to:
Sign the collection of list items
- Collect up all of the appropriate fields in all of the list items (the master and its details).
- Serialize them into a "bundle of bits." This operation needs to be repeatable in the same way each time. Eg, the detail records need to be ordered by line item number.
- Use the CoSign SAPI API to sign the bundle of bits and generate the signature as a "detached signature." This is easy to do with the CoSign API. Example.
- Save the detached signature back into the SharePoint system. I'd create a
signature field as part of the Master list items. Of course, you will NOT include the contents of the signature field when you serialize your set of data in step 1, above.
Verify the signed collection of list items
Write a function to enable the SP user to
verify a set of your data:
- Repeat step 1 from above.
- Repeat step 2 from above.
- Retrieve the "signature" field from the master record stored in step 4 above. Use it and the SAPI verification function to verify that the current value of the bundle of bits matches the signature.
- Show the verification results to the user. You may also want to store the verification results as additional fields in the master record for easy listing when viewing the library. In that case, be sure to clear the verification result field whenever any of the data is changed.
You will also want to handle multiple signatures per data set. Not hard but beyond the scope of this answer.
CoSign digital signatures are used for many many CFR21 Part 11 applications, so that's not a problem.
But usually the verification process can either be done by the originating software or by external software. I don't know whether CFR21 requires the ability to externally verify the signatures. If so, then you'll also need a way to export both your serialized data and the detached signature for verification by a third party. You may be able to wrap them together in one of the XML signed data standard formats. You can contact CoSign sales and CoSign Professional Services for additional help.