I reference object in some of my code in hashes. The signature is itself is another object separate from the one I am signing (for obvious reason). I consider simpler to simply sign the reference to my object (its hash), but I wonder if it is considered secure.
Here's a more complete explanation:
A: Is the data object to be hash then signed
H: Is hash(a), the reference to A
S: Is the signature object which contain H and sign(H)
S and A are sent on the network so A can be verified with its signature