A separate service on its own origin. The form embedding this can ask whether a required document exists and when it lapses. It never receives the documents.
Tools are registered with exposedTo naming only the embedding form's origin, so no other site can
discover them.