When Inksign seals a document, it produces a PAdES signature. If you've never seen the term, here's what it means and why it's the right foundation.
The short version
PAdES, short for PDF Advanced Electronic Signatures, is a set of standards (ETSI EN 319 142) that define how a cryptographic signature is embedded inside a PDF. It's the profile recognized under the EU's eIDAS regulation and interoperable with tools like Adobe Acrobat. In other words: it's the format that lets a signature made in one program be verified in another.
What a PAdES signature actually proves
A valid PAdES signature answers three questions about a document:
- Integrity: has the content changed since it was signed?
- Coverage: does the signature cover the whole file, or just part of it?
- Identity: which certificate signed it?
Inksign layers timestamps on top where available (the B-T level), so a signature can be shown to have existed at a point in time even after a certificate expires.
Where the QR code fits
Every Inksign signature can carry a small verification anchor, a QR code encoding the signer's certificate fingerprint and the content hash. It's a convenience, not the proof: scanning it tells you what the signature claims, and the embedded PAdES signature is what actually backs the claim. You can try it on the verify page.
Why not roll our own?
Because a signature only matters if someone else can check it. Building on PAdES means an Inksign-signed document isn't locked to Inksign; it's a standard file that any compliant reader, in any country, can verify.