Verifiable document redacting