The ceremony
Before an applicant can mint, seven standing citizens must each sign an attestation: a typed, structured statement binding the witness to that applicant. Each attestation names the applicant's address, the hash of their declared name, a one-time nonce, and a deadline. The witness signs it with their own wallet, on their own device.
Why it cannot be forged or reused
Attestations use the EIP-712 typed-data standard under the passport contract's own domain, so a signature produced for CryptRepublic verifies nowhere else and vice versa. The nonce ties each attestation to one specific application — a captured signature cannot be replayed for a second applicant or a second attempt. The deadline expires stale signatures. At mint time the contract itself recovers all seven signers and checks each is a standing citizen; the server's opinion is never the deciding voice.
The witness's stake
Witnessing is not a click-through. A witness ordinarily attests for people they referred — people they actually know. An attestation given to an applicant the witness knows to be false, duplicate, or coerced is a Grade III offence under the Penal Code: the witness's trust score answers for it, and witness eligibility is suspended. Seven honest signatures are the Republic's border control, and the border is guarded by the citizens themselves.