When a download link isn't enough
The forwarded link
You send someone a private file as a signed link. The signature means a stranger cannot guess the address. It does not mean a stranger cannot receive it. The message gets forwarded, the mailbox is shared, the link lands in a chat. The file now sits in front of someone you never chose, and nothing has asked them a single question.
Ask one more question
For most content that is fine. For a contract or a personnel record it is not. The missing step is small: before the file downloads, ask the reader to prove — with hardware — that they are the person the link was meant for. A security key or a smart card signs a challenge that a password or a copied link cannot fake.
The user does one thing: touch the key. The server sees that the touch happened and releases the file. A link that leaks now buys the finder nothing, because the file still asks for their key, not the intended reader's.
The one-touch rule
People route around security that gets in the way, so the extra step has to be light. Open the link, get sent to sign in, touch the key, download. No code to paste, no second app, no token to copy. If they signed in with the same key a moment ago, the file may just arrive.
Make failure plain too. An expired link should say so and offer a fresh one, not drop the reader on an error page.
Why now
Two things changed. Hardware authentication went mainstream: security keys are cheap, and government already carries PIV and CAC cards. And the rules caught up — federal guidance now expects phishing-resistant sign-in for anything sensitive. Gating a download behind a key is no longer exotic. It is the reasonable default for a file that matters.
The link protects the address. The key protects the reader. High-value files need both.