Know what your PDF signature actually proves

People use "electronic signature" and "digital signature" as if they were two names for the same thing. In a PDF workflow they are not. One is a broad legal and business concept; the other is a specific technical mechanism built from hashes, private keys, certificates, and reader validation.

That distinction matters when a document leaves your desk. A drawn mark may be perfectly sensible for an internal approval or a routine form. A tender submission, statutory filing, or notarised deed may ask for a verifiable digital signature, a trusted certificate, or a timestamp. Requirements vary by jurisdiction and by receiving body, so treat this as technical guidance rather than legal advice.

If you only need the practical steps for placing a signature mark, the related post on signing a PDF without uploading it covers that workflow. This article stays in the narrower lane: what each kind of signature proves, what it does not prove, and why editing a signed PDF can break the evidence you meant to preserve.

An electronic signature is a broad signal of intent

An electronic signature can be almost any electronic act that indicates someone intended to sign or approve something. It might be:

• a typed name at the end of a PDF form
• a drawn squiggle placed on a signature line
• an image of a wet signature pasted onto the page
• a tick box followed by an "I agree" button
• an email reply saying the attached terms are accepted

The PDF itself may contain only the visible mark. The rest of the evidence often lives outside the file: the email trail, the account used to submit the form, the audit log, the surrounding contract, the behaviour of the parties, and the rules that apply where the document is used.

That is why a simple mark can be appropriate for low-risk documents. If your manager asks you to acknowledge a policy, a drawn signature placed with the PDF signing tool may be enough for the organisation's process. The important thing is that everybody understands what is being recorded: a human-facing indication of approval, not a cryptographic guarantee about the bytes in the file.

A digital signature is a cryptographic operation

A digital signature is more specific. The signing software calculates a hash of the PDF's relevant bytes. A hash is a fixed-length fingerprint of the file: the same bytes produce the same value, while a tiny change produces a different one. The software then signs that hash using a private key associated with a digital certificate and embeds the signature data in the PDF.

When someone opens the file later, their reader can repeat the hash calculation and compare it with the signed value. If the document bytes have changed since signing, validation fails or shows that the signature has been invalidated. That is the core technical promise: the signed version and the version being viewed are not silently different.

You can see the same integrity idea in simpler form with a PDF fingerprint. A fingerprint does not identify a signer, but it does show why byte-level changes matter. Two PDFs can look identical on screen and still have different fingerprints because a timestamp, metadata field, optimisation pass, or page object changed underneath.

What the certificate authority adds

A certificate connects a public key to an asserted identity. A certificate authority is the organisation that issues that certificate after applying its own checks. Reader software decides whether to trust the signature partly by looking at whether the certificate chains back to an authority in its trust store.

That trust chain is why a self-signed certificate commonly shows as untrusted. The cryptography may still work: the PDF can still prove that the file has not changed since it was signed by the matching private key. What is missing is an outside authority that the reader already trusts to vouch for who controlled that key. In practical terms, the reader is saying, "I can verify the seal, but I do not know whether I should trust the name on it."

This is also why certificate handling is not a cosmetic detail. If a filing portal, procurement process, or regulator requires a particular class of certificate, a visible signature image will not satisfy that requirement, and a self-signed certificate may not either.

What a digital signature proves and what it does not

A valid digital signature can prove two technical facts:

1. the document has not changed in a way that invalidates the signed byte range since the signature was applied
2. the signature was produced using the private key corresponding to the certificate shown in the PDF

Those are useful facts, but they are not the whole story. A digital signature does not prove, by itself, that a particular human understood the document or intended every legal consequence. It does not prove that the certificate subject is truthful if the issuing process was weak. It does not prove exclusive human control if the private key was shared across a team, left on an unlocked token, or used by automation without a proper approval step.

In other words, the cryptography protects the file's integrity and links the signature to a key. The business process around the key still matters. For a serious workflow, that means controlling who can use the certificate, keeping tokens and passwords separate, logging approvals, and knowing which rules apply to the document type.

Why timestamps matter after expiry

Certificates expire. Without a trusted timestamp, a reader may struggle to tell whether a signature was applied while the certificate was valid or after it had expired or been revoked. A timestamp authority gives the signature an independent time marker: this signature existed at this stated time.

That matters for long-lived records. A contract signed today may be opened five years later, after the certificate has expired. A good timestamp helps the reader validate the signature historically instead of treating the later expiry as if it automatically spoiled the earlier signature. The exact validation rules depend on the reader, the certificate type, and the policy of the body receiving the file.

Why images, flattening, and re-saving cause confusion

Pasting an image of a signature onto a PDF is an electronic signature. It is not a digital signature. The image is page content or an annotation; it has no private key, no certificate chain, and no cryptographic hash that will warn a reader if the rest of the document changes.

Flattening has a similarly sharp boundary. The PDF flattening tool can be the right final step for a drawn or typed signature, because it merges annotations and form values into the page so they print consistently and cannot be dragged away as separate objects. But flattening a certificate-signed PDF is a modification to the file. So is re-saving it through many editors, optimisers, print-to-PDF drivers, and page organisers. If the changed bytes fall inside the signed range, the signature no longer validates.

That is not a bug. It is the point of a digital signature. The PDF reader is warning that the file being opened is not the exact signed byte sequence. If you need to combine, compress, flatten, or otherwise alter the document, do those operations before applying the digital signature, then stop editing.

Choose the signature for the risk

Use an electronic signature when the document process mostly needs a visible record of approval: internal acknowledgements, simple forms, meeting approvals, or low-risk agreements where the surrounding context carries the evidence. Keep a copy of the final PDF and the message or workflow that shows why the mark was placed.

Use a digital signature when the recipient needs machine-verifiable integrity and a certificate-backed signer: tender submissions, statutory filings, regulated reports, high-value contracts, or documents that will be archived and challenged later. Confirm the required certificate class, timestamp rules, and allowed PDF changes before signing.

A short checklist

• Decide whether you need intent evidence, cryptographic integrity, or both.
• Place drawn or typed marks with the PDF signing tool when an electronic signature is enough.
• Use certificate-backed signing only with a private key you can protect.
• Check whether the recipient requires a trusted certificate authority or timestamp.
• Do all editing, flattening, and re-saving before applying a digital signature.
• Use a fingerprint when you need a simple byte-level check that two copies match.