How a signed document is secured

An electronic signature captures intent. It does not, by itself, prove that the document you are reading today is the document that was signed. That second job belongs to cryptography, and it is what separates a checkbox on a web form from a signature that survives being challenged.

The mechanism has three parts. A hash function — SHA-256 in practice — reduces the file to a fixed-length fingerprint that changes completely if a single byte changes. A private key, held by a certificate authority on the signer's behalf, signs that fingerprint. And a certificate issued by an authority in a trust list vouches for whose key it was. Alter the document afterwards and the fingerprint no longer matches the one inside the signature, so any reader can detect it. That is the whole of what "tamper-evident" means: not that the file cannot be changed, but that a change cannot be hidden.

Two supporting pieces decide whether that proof still works years later. A trusted timestamp from an independent authority establishes when the signature was made, so it remains valid even after the signing certificate expires. And a trust list — the Adobe Approved Trust List is the one most people encounter — is why a reader's software shows a green check without anyone configuring anything.

The guides below take each layer on its own: hashing, PKI, certificates, timestamps, the trust providers behind them, and what a certificate of completion actually records.