Extract sign-off mark-up, disable when not mine

The disabled checkbox is purely cosmetic - the controller will not
persist the change - but it avoids user confusion.