1. A computer-implemented method comprising: receiving, by a computing device processor, an electronic document including a plurality of content items, a rule, a first digest, and a digital signature of a document author, wherein the rule identifies a subset of the content items that are invariant to operations authorized by the rule; generating a second digest for the electronic document by digesting the subset of content items that are invariant to operations authorized by the rule, wherein content items that are modifiable pursuant to the rule are not considered in generating the second digest; comparing the first and second digests; invalidating the digital signature of the document author in response to detecting a discrepancy between the first and second digests, and restricting access to the electronic document in response to detecting the invalidated digital signature.
1. A computer-implemented method comprising: receiving, by a computing device processor, an electronic document including a plurality of content items, a rule, a first digest, and a digital signature of a document author, wherein the rule identifies a subset of the content items that are invariant to operations authorized by the rule; generating a second digest for the electronic document by digesting the subset of content items that are invariant to operations authorized by the rule, wherein content items that are modifiable pursuant to the rule are not considered in generating the second digest; comparing the first and second digests; invalidating the digital signature of the document author in response to detecting a discrepancy between the first and second digests, and restricting access to the electronic document in response to detecting the invalidated digital signature. 3. The method of claim 1 , wherein: generating the second digest includes using a multi-layer hash function that includes a bottom layer and an intermediate layer; the bottom layer provides recursive digesting functionality; and the intermediate layer provides annotation digesting functionality and is configured to call the bottom layer.