Digital signatures on PDFs: what they prove — and what they don't

First, clear one thing up, because the confusion is near-universal: a picture of a handwritten signature pasted into a PDF is not a digital signature. It's decoration. It proves nothing, secures nothing, and can be copied out of one document into another in ten seconds. A real digital signature is invisible mathematics — and it works like this.

How a real signature works

When a PDF is digitally signed, the signing software takes a cryptographic digest — a fingerprint — of essentially all the document's bytes, and encrypts that fingerprint with the signer's private key. The result is embedded in the file along with a certificate identifying the key's owner.

The consequence is absolute in a way little else in forensics is: change any byte of the signed content, and the digest no longer matches. Not "probably detectable" — mathematically guaranteed to be detectable. Flip one pixel, move one comma, and the signature breaks. When a signature validates, you know the document in front of you is, byte for byte, the document that was signed. That's a certainty most evidence can only dream of.

The trick to actually watch for: signed, then modified

Here's the part that catches people who think a signature settles everything. The PDF format allows changes to be appended after a signature — that's legitimate machinery (it's how a second person adds their signature below the first). The original signature still validates, because the originally-signed bytes are still intact... but the document now says something different than it did when it was signed.

A viewer that only reports "signature valid ✓" can wave through a document whose visible content changed after signing. The right question is never just "does the signature validate?" — it's "has anything been added since it was signed?" Any serious verification distinguishes these cases: signed and untouched, signed with benign later additions (a second signature, a date stamp), and signed with content changes after signing — which is a polite phrase for the oldest trick in the book wearing a cryptographic disguise.

The four claims, sorted

What a valid signature does prove:

• The signed bytes are unchanged since signing — integrity, absolute.
• The signer possessed the private key matching the embedded certificate.

What it does not prove:

• Who the signer really is. Anyone can create a certificate that says anything — I could sign a document as "The Central Bank" this afternoon. Identity only means something when the certificate chains to an authority you trust, and checking that chain is a separate, harder question than checking the math.
• That the content is true. A fraudulent invoice, carefully signed by the fraudster, validates perfectly. The signature honestly certifies a dishonest document.

And the unsigned majority

One more calibration, because people over-read absence too: most legitimate documents are not signed at all. Invoices, statements, certificates, contracts — the overwhelming majority of consumer and business PDFs carry no digital signature. Its absence is not a red flag; it's Tuesday. Where absence is interesting is in contexts that mandate signing — some government-issued documents, some regulated filings. A missing signature on a document type that always carries one is worth a question.

For everything unsigned, verification falls back to the file's other testimony: revision history, metadata consistency, and font evidence.