The consumer's picture of a digital signature
Ask a consumer to explain a digital signature and they will describe the squiggle. The screen prompts them to sign; they draw with a finger, or type their name, or click a box marked "sign here"; and something on the other end treats the result as agreement to the terms on the page above. The word "signature" carries a picture, and the picture is wet ink on paper.
None of that describes what actually happened. The squiggle is not the signature. The signature is a piece of cryptography — a hash of the document combined with a private key, producing an output that a verifier checks against a public key associated with a certificate issued to a person. Whether that person was the one who touched the screen is not what the cryptography establishes. The cryptography establishes that a key was used. Nothing in the cryptography establishes who used it.
The consumer does not know this. They see the squiggle and assume the squiggle is the signature, in the way it was on the last mortgage form their parents ever signed with a pen. They do not know what they are signing, in the sense that click-to-agree terms are usually unread. They do not know how they are signing, in the sense that the mechanism binding their intent to the document is invisible to them. The interface shows a mark. The meaning is somewhere the consumer cannot see.
The tier system under eIDAS
The eIDAS Regulation defines three tiers of electronic signature. A plain electronic signature counts as a signature by default. An advanced electronic signature adds requirements around linking to the signatory, control at the moment of signing, and tamper detection on the signed data. A qualified electronic signature adds a qualified certificate from a qualified trust service provider, on a qualified signing device, and is recognised across the EU as equivalent to a wet signature.
The framing is escalating security: higher tier, higher assurance, higher stakes. What escalates across the tiers is cost, complexity, inconvenience, and the probability that the relying party is dealing with the right person. What does not escalate to full at any tier is certainty.
Identity is binary. Either the system knows with certainty which human took the action, or it does not. No tier of eIDAS produces that certainty. A qualified certificate is issued to a person who satisfied a KYC procedure at some moment in the past. The qualified signing device confirms that a valid signature was produced at the moment of signing. Nothing in the chain confirms, at the moment of signing, that the person invoking the private key is the same person the certificate refers to.
The tiers are honest about that uncertainty. Higher tiers require more procedure, more paperwork, more expensive devices, and more regulated third parties. Each of those things raises the cost of attack for a bad actor and lifts the probability that the person signing is genuine. A lifted probability is not a resolved gap. It is a bet that the value of what is being signed is lower than the cost of defeating the safeguards. That bet fails often enough that regulation defines the compensation regime alongside the assurance regime.
In 2021, the Reverend Mike Hall — a clergyman who had owned a house in Luton for around thirty years — returned from working in north Wales to find it emptied, sold, and a new owner in residence. Somebody had impersonated him with a forged passport, a duplicate driving licence, and a bank account opened in his name. The conveyancing firm's electronic ID check ran cleanly against those documents. The estate agent's checks ran cleanly. The title transferred at HM Land Registry. Every procedural step was correctly performed. No step observed that the person operating them was not the person the operations were about.
Identity, cryptography, and attestation
Solve the identity problem — establish, binarily, which specific human took a specific action at a specific moment — and cryptography does the rest.
A live biometric gate on the user's own device, bound to an identifier the relying party sees but cannot join up with any other context the person operates in, attests that a specific person was present when the private key was invoked. The signature is that attestation, wrapped in a form the counterparty can verify. No chain of certificates carries the identity claim; no trust service provider vouches for it; no insurance fund of last resort catches it when it fails. The witness is the mathematics itself, given something worth witnessing by the human being present at the moment of signing.
Signatures beyond documents
Strip the metaphor away and what remains is not a mark. What remains is the establishment, verifiable by anyone who cares to check, that a particular person carried out a particular act at a particular moment. The mark was evidence of that establishment in an environment where the alternative was memory and testimony. The paper was the substrate that carried the mark. Neither was ever the signature itself. The metaphor confused evidence with substance, and confused a particular surface with the thing that could happen on any surface.
The theoretical consequence is that the space of things a signature can bind is much larger than the space of documents. If the signature is the binding between a person and an act, then any interaction that expresses an act — an exchange in a messaging system, a transactional confirmation, the delegation of authority to a software agent that will act on behalf of a person, an action taken by a person in an organisational role — can be signed. The research question is what a generalisation of that kind means for how agreements are formed once the substrate stops mattering and the binding itself becomes the object of study.
