Electronic vs Digital Signatures: What Actually Holds Up

The two terms get used interchangeably and they are not the same thing. One is a picture of intent. The other is a mathematical claim about the document's integrity and the signer's identity. Most agreements are fine with the first; some are not.

Electronic signatures

An electronic signature is any electronic mark made with intent to sign: a typed name, a drawn squiggle, a checkbox, a click on an 'I agree' button. In most jurisdictions — including the EU under eIDAS, the US under ESIGN/UETA, and South Africa under ECTA — a plain electronic signature is legally valid for the large majority of commercial contracts.

What makes it defensible is not the image; it is the surrounding evidence. Timestamp, IP address, email verification, an unbroken audit trail, and a copy of what the signer actually saw at the moment of signing. If a signature is challenged, the audit trail is the exhibit — not the squiggle.

Digital signatures

A digital signature is a specific cryptographic mechanism: a hash of the document is encrypted with the signer's private key, and a certificate from a trusted authority binds that key to an identity. Any change to the file after signing invalidates the signature, visibly, in any compliant reader.

This gives you two things a drawn signature cannot: tamper-evidence, and identity attested by a third party rather than by the signer's own claim.

Which do you need?

• Standard commercial contracts, NDAs, engagement letters, quotes: electronic signature with a solid audit trail is normal and accepted.
• Documents filed with a court or public registry: check the specific requirement — many mandate a qualified digital certificate.
• Wills, certain property transfers, some notarial acts: frequently excluded from electronic signing entirely. Check local law.
• Cross-border deals into the EU where the contract specifies a Qualified Electronic Signature: you need a QES from a listed trust service provider. Nothing else satisfies it.

Practical mistakes to avoid

1. Signing, then editing. Any post-signature edit — even adding page numbers — invalidates a digital signature and undermines an electronic one.
2. Flattening a signed PDF. It destroys the signature object while leaving the visual mark, which looks fine and proves nothing.
3. Merging signed documents. Merging always breaks digital signatures. Attach them as separate files instead.
4. Keeping only the final PDF. Keep the audit trail alongside it; the PDF alone is weak evidence.

A reasonable default

For everyday business documents: sign electronically, capture a timestamped audit record, lock the document afterwards so nothing can be edited, and store the signed file and its trail together. Escalate to a certificate-based digital signature only when a counterparty or a regulator asks for one — and when they do, ask them exactly which standard they require, because 'digitally signed' means at least four different things in practice.

The three tiers under eIDAS, and why the naming trips people up

eIDAS defines three levels that most non-EU vendors gloss over: a Simple Electronic Signature (SES), which is any electronic mark; an Advanced Electronic Signature (AES), which must be uniquely linked to the signer, capable of identifying them, created using data under the signer's sole control, and linked to the document so that any later change is detectable; and a Qualified Electronic Signature (QES), which is an AES created with a qualified signature creation device and backed by a qualified certificate from a provider on an EU trust list.

Only a QES carries the automatic legal equivalence to a handwritten signature across all EU member states. An AES is strong evidence but can still be challenged on the facts; an SES is valid but carries the least evidentiary weight on its own. Vendors frequently market a product as 'eIDAS compliant' when it only reaches SES or AES — ask specifically which tier the tool certifies to before relying on it for a QES-required contract.

How US law treats the same problem differently

The US federal ESIGN Act and the state-level Uniform Electronic Transactions Act (UETA) take a functional approach rather than a tiered one: an electronic signature is valid if the parties intended to sign and consented to do business electronically, full stop. There is no US federal equivalent of a mandated 'qualified' tier for general commercial use. This is why a typed name with a timestamp and IP log is routinely enforceable in US courts for contracts that would need a QES to satisfy certain EU statutory requirements — the two legal systems are not solving the same problem the same way, and assuming US practice satisfies an EU counterparty's QES clause is a common and expensive mistake.

What actually happens when a digitally signed PDF is tampered with

Open a digitally signed PDF in a compliant reader after even a single byte has changed — a comment added, a page rotated, metadata edited by an unrelated tool — and the signature panel flips from a green checkmark to a red or amber warning stating the document has been modified since signing. Crucially, the visible page content usually still looks identical; the warning lives in the signature panel, which many casual readers never open. This is the core danger of relying on the visual signature block alone: a forged or broken signature does not make the page look wrong, so verification has to be an active step, not a glance.

A short worked scenario: the merged-PDF mistake

A supplier sends a digitally signed purchase order. The buyer's finance team merges it with a signed delivery note into a single PDF for their records, because that is convenient for filing. Both signatures now show as invalid, because merging rewrote the underlying byte structure of each file. Six months later, during a dispute, the buyer cannot produce a validly signed purchase order — only a merged PDF with two broken signature objects and a visual signature block that proves nothing on its own. The correct process is to keep signed documents as separate immutable files and reference them by filename in an index, never combine them post-signature.

A troubleshooting checklist for questioning any 'signed' PDF

1. Open the signature panel directly, not just the page — does the reader report the signature as valid, and as unmodified since signing?
2. Check the certificate chain: is it issued by a trust provider your reader actually recognises, or a self-signed certificate with no external attestation?
3. Confirm the signing time comes from a trusted timestamp authority, not just the signer's local clock, which can be set to anything.
4. If the contract specifies a QES, ask for the provider name and check it against the relevant national trusted list — do not accept 'it's digitally signed' as sufficient.
5. Verify the file has not passed through a merge, flatten, or print-to-PDF step after signing, all of which strip or invalidate signature objects.

"A valid-looking signature block proves someone drew or applied a mark. Only the signature panel's own validation proves the document has not changed since."

Long-term validation: the problem nobody plans for

A certificate used to create a digital signature has an expiry date, typically one to three years. Once it expires — or is revoked — a reader validating the signature years later cannot confirm the certificate was valid at the moment of signing unless the signature was created with a trusted timestamp and, ideally, embedded revocation information (an approach standardised as PAdES, the PDF Advanced Electronic Signatures profile used across the EU). Without that, a perfectly legitimate signature from four years ago can start showing as 'unknown' or 'unable to verify' in a reader today, not because anything was tampered with, but because the certificate infrastructure behind it has aged out. For anything you need to defend in ten years, ask specifically whether the signing process embeds a trusted timestamp and long-term validation data — plain digital signing without it is not built to last.