IMO the crazy part is reusing the input directly, instead of normalizing, serializing, then verifing signature, deserializing and only ever trusting the deseria

IMO the crazy part is reusing the input directly, instead of normalizing, serializing, then verifing signature, deserializing and only ever trusting the deserialized verified data. This way you always accept as validated exactly the same input that is signed, and any normalization or processing is irrelevant¹. OTOH, once you do it like this, I'm not sure what's the benefit of allowing malleable data in the first place. You may need to splice data back from multiple signed parts, but I'm not sure what else would be proper, if only parts of a document are signed. -- Note: Only ever trust SignedData. playWithData :: Dangerous -> Dangerous -> Dangerous verifySignature :: Dangerous -> VerificationParameters -> (SignatureInfo, Maybe SignedData) ¹ Normalization/processing will be exposed to attackers, so it still needs to be memory and computationally safe, and you should carefully evaluate do you really need preprocessing.