Redact a PDF and prove it

The point of the exercise is that "it looks redacted" proves nothing, so the work is in the verifier. It checks what a reader could do: copy the text, read the document properties, look under the boxes, extract the images, and OCR the rendered page. The decision that matters most is giving the statement personal data in more than one place. A statement with names only in the text layer would make apply_redactions look like the whole answer, and it isn't: the metadata keeps the name unless you clear it.