What a signature proves, and what it doesn't.
A signature answers four questions: who, what, when and with what intent. Cryptography settles only some of them.
When an agreement ends up in dispute, nobody asks whether the document "has a signature." The questions are different: who signed it, what exactly it said at that moment, when it happened, and whether the person signing understood what they were agreeing to. A signature is worth exactly as much as the answers to those four questions.
With handwritten signatures it was never any different. A stroke of ink on paper proves little by itself; its strength came from context: the witnesses, the notary, the copy each party kept, the stamp of the office that received the file. Electronic signatures did not change the questions. They changed where we look for the answers.
The four questions
- Who? Attribution: the signature can be linked to a specific person, not to anyone who happened to have access to a device or a password.
- What? Integrity: the signed content is exactly what is being presented today, down to the last comma.
- When? Time: the moment of signing can be proven and does not depend on the clock of whoever produced the signature.
- With what intent? Consent: there was a genuine will to be bound, not an accidental click or a screen that showed something else.
What cryptography contributes
A certificate based digital signature solves one part of the problem very well. It guarantees that the document has not changed since it was signed, because any alteration breaks verification. And it guarantees that the signature was produced with a private key that corresponds to a specific certificate, issued in someone's name.
That is a great deal, but it is not everything. Cryptography does not know who controlled the key at that instant, whether the person read the document, or whether they had authority to sign on behalf of a company. And unless a timestamp issued by a third party is involved, it does not know when the signing happened either.
| Question | What the cryptographic signature resolves | What the rest of the evidence must supply |
|---|---|---|
| Who | Links the signature to a certificate and its holder. | How identity was verified when the certificate was issued, and who controlled the key at the time of signing. |
| What | Detects any later alteration of the content. | That what was shown on screen matches what was signed. |
| When | Nothing, if only the device clock is used. | A timestamp from a trusted third party. |
| Intent | Nothing on its own. | The signer's journey: what they saw, what they accepted, and in what order. |
What the law says
Electronic signature laws almost everywhere rest on the same idea, functional equivalence, articulated by the United Nations Commission on International Trade Law (UNCITRAL) in its 1996 Model Law on Electronic Commerce and developed further in the 2001 Model Law on Electronic Signatures. An electronic method fulfills the function of a signature if it identifies the person, indicates that they approve the content, and is as reliable as is appropriate for the purpose of the transaction.
From there, most legal systems distinguish levels. The European eIDAS Regulation (910/2014) separates simple, advanced and qualified signatures, and gives the qualified electronic signature a legal effect equivalent to a handwritten one. In Uruguay, Law 18,600 of 2009 distinguishes the electronic signature from the advanced electronic signature, which it recognizes as having the same validity as a handwritten signature. Brazil adopted a three level scheme with Law 14,063 of 2020.
What changes from one level to the next is not whether the signature "counts," but who has to prove what. With a high level signature, the burden of showing that something went wrong usually falls on whoever challenges it. With a simple signature, whoever relies on it must reconstruct the rest of the story. Either way, it is the evidence surrounding the signature that ends up deciding the matter.
What to preserve
- The signed document, in a format that allows it to be verified without relying on the system that produced it.
- The certificates and their chain up to a recognized authority.
- The revocation information valid at the time of signing.
- A timestamp issued by a third party.
- The event log: delivery, opening, identification, acceptance and completion, chained so that it cannot be edited without leaving a trace.
Every signature answers four questions: who, what, when and with what intent. Cryptography answers the second one very well and part of the first; the others depend on the evidence that is preserved. Choosing a signature level means choosing who will have to prove what on the day a doubt arises.