Signing system for validating stateful hash-based digital signatures, comprising at least one signing device (21, 31), a logging device (22, 32) and a verifying device (23, 33), wherein each signing device is configured to - receive data to be signed, - generate a hash-based digital signature comprising a one-time signature calculated for the data based on a one-time private key, - generate a one-time public key based on the one-time signature, - send the generated one-time public key to the logging device (22, 32), - send the hash-based digital signature to the verifying device (23, 33), the verifying device (23, 33) is configured to - generated a validation one-time public key based on the hash-based digital signature and the data, - send the validation one-time public key to the logging device, and the logging device (22, 32) is configured to - store the generated one-time public key, - receive a validation one-time public key, - compare the validation one-time public key with all one-time public keys stored in the logging device (22, 32), and - provide a validation feedback signal to the verifying device (23, 33), if the validation one-time public key coincides with exactly one stored one-time private key, and - provide a warning feedback signal, if the validation one-time public key does not coincide with exactly one stored one-time private key to the verifying device (23, 33). - receive data to be signed, - generate a hash-based digital signature comprising a one-time signature calculated for the data based on a one-time private key, - generate a one-time public key based on the one-time signature, - send the generated one-time public key to the logging device (22, 32), - send the hash-based digital signature to the verifying device (23, 33), the verifying device (23, 33) is configured to - generated a validation one-time public key based on the hash-based digital signature and the data, - send the validation one-time public key to the logging device, and - generated a validation one-time public key based on the hash-based digital signature and the data, - send the validation one-time public key to the logging device, and the logging device (22, 32) is configured to - store the generated one-time public key, - receive a validation one-time public key, - compare the validation one-time public key with all one-time public keys stored in the logging device (22, 32), and - provide a validation feedback signal to the verifying device (23, 33), if the validation one-time public key coincides with exactly one stored one-time private key, and - provide a warning feedback signal, if the validation one-time public key does not coincide with exactly one stored one-time private key to the verifying device (23, 33). - store the generated one-time public key, - receive a validation one-time public key, - compare the validation one-time public key with all one-time public keys stored in the logging device (22, 32), and - provide a validation feedback signal to the verifying device (23, 33), if the validation one-time public key coincides with exactly one stored one-time private key, and - provide a warning feedback signal, if the validation one-time public key does not coincide with exactly one stored one-time private key to the verifying device (23, 33).