...
Currently the specification states that the whole VERSION (i.e., ORIGINAL_VERSION or IMPORTED_VERSION) should be signed and that the signing process needs to be performed on the server.
A suggestion has been made to allow signing by client applications - i.e. retrieve the whole VERSION create a signature and save it back, which means we would take out the last paragraph in section 6.2.7. and perhaps also modify what is to be signed (only a COMPOSITION instead of a VERSION).