Desk

A drop is hashed for its body, signed on this device, and stamped with creator and time. The private key never leaves this phone. The preview database can forget. The signed blob stays.