Two signatures.
That is all it takes.

// Add to Cargo.toml:
//   secp256k1 = { version = "0.27", features = ["rand"] }
//   sha2 = "0.10"
use secp256k1::{Secp256k1, Message};
use secp256k1::rand::rngs::OsRng;
use sha2::{Sha256, Digest};

fn sign_and_verify_demo() {
    let secp = Secp256k1::new();
    let (private_key, public_key) =
        secp.generate_keypair(&mut OsRng);

    let message = b"Send 1 BTC to Alice";

    // Step 1: hash the message. Bitcoin uses double SHA-256.
    let hash1 = Sha256::digest(message);
    let hash2 = Sha256::digest(hash1);
    let msg = Message::from_digest_slice(&hash2)
        .expect("32 bytes");

    // Step 2: sign with the private key. The crate generates
    // a deterministic RFC 6979 nonce k internally, so there is
    // no nonce to reuse and no RNG to break at signing time.
    let signature = secp.sign_ecdsa(&msg, &private_key);
    println!("Signature: {} bytes",
             signature.serialize_der().len()); // 71-72

    // Step 3: verify with the public key. No private key needed.
    let valid = secp.verify_ecdsa(&msg, &signature, &public_key);
    println!("Valid: {}", valid.is_ok());

    // Now tamper with the message and verify again.
    let tampered = b"Send 100 BTC to Alice";
    let t1 = Sha256::digest(tampered);
    let t2 = Sha256::digest(t1);
    let t_msg = Message::from_digest_slice(&t2).unwrap();

    let tampered_valid =
        secp.verify_ecdsa(&t_msg, &signature, &public_key);
    println!("Tampered valid: {}", tampered_valid.is_ok()); // false
    // One changed digit. Verification fails completely.
    // That is the integrity guarantee in action.
}

/* Compile: gcc sign.c -o sign -lssl -lcrypto */
#include <openssl/ec.h>
#include <openssl/ecdsa.h>
#include <openssl/obj_mac.h>
#include <openssl/sha.h>
#include <string.h>
#include <stdio.h>

void sign_and_verify_demo(void) {
    EC_KEY *key = EC_KEY_new_by_curve_name(NID_secp256k1);
    EC_KEY_generate_key(key);

    const char *message = "Send 1 BTC to Alice";

    /* Step 1: double SHA-256 (Bitcoin standard) */
    uint8_t hash1[32], hash2[32];
    SHA256((const uint8_t*)message, strlen(message), hash1);
    SHA256(hash1, 32, hash2);

    /* Step 2: sign. ECDSA_sign generates the nonce k
     * internally. It must be unique on every call. */
    uint8_t  sig[72];
    unsigned sig_len = sizeof sig;
    ECDSA_sign(0, hash2, 32, sig, &sig_len, key);
    printf("Signature: %u bytes\n", sig_len);

    /* Step 3: verify */
    int valid = ECDSA_verify(0, hash2, 32, sig, sig_len, key);
    printf("Valid: %d\n", valid); /* 1 = valid */

    /* Tamper with the message */
    const char *tampered = "Send 100 BTC to Alice";
    uint8_t t1[32], t2[32];
    SHA256((const uint8_t*)tampered, strlen(tampered), t1);
    SHA256(t1, 32, t2);

    int tampered_valid =
        ECDSA_verify(0, t2, 32, sig, sig_len, key);
    printf("Tampered valid: %d\n", tampered_valid); /* 0 */
    /* One changed character. The signature no longer matches. */

    EC_KEY_free(key);
}