Electronic vs digital signature

An electronic signature is an act

It is a person indicating they adopt a document, by whatever electronic means. A drawn mark, a typed name, a tick, in some settings an email reply. It is about intent and identity, and it is only as convincing as the record around it. On its own, an image of a signature pasted onto a page proves almost nothing, which is why the record matters more than the picture.

A digital signature is a calculation

It is a cryptographic operation over the bytes of a file, made with a private key whose matching certificate says who holds it. It proves two things very well: the file has not changed since the operation, and it was performed by whoever holds that key. Notice what is missing. It says nothing about whether a human intended to agree to anything, because it is not an act of agreement, it is arithmetic.

A finished file here carries both

Each party performs an electronic signature: they pass an identity check, they tick a consent line, they produce a mark by drawing or typing, and that mark is stamped onto the page where you placed the field. Then, once everybody has finished, the whole file receives a digital signature, applied as a PAdES structure with the strictest certification level, so nothing can be added afterwards without a reader noticing.

Whose key signs it matters

This is the part vendors are usually vague about, so it is worth stating. The digital signature is made with the platform's certificate, not with a certificate belonging to each individual signer. It attests that this file, containing these signatures, was issued by this service and has not changed since. It is not a per person credential, and we do not claim it is an advanced or qualified signature under any regime that defines those terms.

Which one answers which question

Who agreed and when is answered by the electronic side, and the evidence for it lives on the certificate of completion: the verification method, the timestamps, the address, the consent version and the hash of the document at each signing moment. Whether the file in front of you is the file that was issued is answered by the digital side, by opening it in a reader that checks signatures. Two questions, two mechanisms, one PDF.

How it works, in three steps

1. Step 1

   Collect the electronic signatures

   Each signer verifies, consents and produces a mark, and each of those moments is recorded against them individually.

2. Step 2

   The file is certified once at the end

   After the final stamp, the whole document is digitally signed and certified so that later changes are detectable.

3. Step 3

   Keep both halves of the evidence

   The certified PDF answers questions about the file. The certificate of completion answers questions about the people.

Limits worth knowing

• The document level signature uses the platform certificate, not a certificate issued to each signer.
• We make no claim to any statutory tier of signature, advanced, qualified or otherwise, under any regime.
• No timestamp authority is configured at present, so the file carries no independent third party time attestation.
• Whether a reader marks the signature as trusted depends on that reader's own trust settings.

Questions people ask

Related pages