TL;DR: Sectigo argues that most e-signature tools still verify only email access, leaving professionals exposed as digital forgeries rise 244% year-over-year and now make up 57% of global document fraud, while U.S. consumers lost $47 billion to identity fraud. Email-based signing cannot prove who signed, what was signed, or whether the file changed after signing; cryptographic binding is the decisive control.
At a glance
What this is: This article argues that everyday document signing has an identity verification gap because many tools rely on inbox access rather than cryptographic proof of the signer.
Why it matters: It matters because IAM and security teams supporting professional workflows need signatures that prove authorship and integrity, not just link a document to an email account.
By the numbers:
- Digital forgeries are up 244% year-over-year.
- Digital forgeries now account for 57% of all document fraud globally.
- U.S. consumers lost $47 billion to identity fraud in a single year.
Context
Digital document signing has become routine for contracts, filings, and agreements, but the trust model behind many tools is still weak. If the signer is only proven by inbox access, the process verifies channel control rather than identity, which is a poor fit for documents with legal or financial weight.
Certificate-based digital signatures close that gap by binding identity to the document itself. They add cryptographic proof of authorship and integrity, which is the real control problem for professional signing workflows.
Key questions
Q: How should enterprises decide when an eSignature is enough?
A: Use an eSignature when the transaction is low risk, the main need is to capture approval, and the business can tolerate lighter identity assurance. If the document is regulated, high value, cross-border or likely to be disputed, the control requirement changes and stronger identity-backed signing becomes the safer choice.
Q: Why do multiple eSignature tools create operational risk?
A: Multiple tools fragment support, evidence, branding, and integration logic across the same transaction model. That makes it harder to standardise controls, troubleshoot issues, and prove what happened in a specific signing event. In platform environments, fragmentation usually creates more governance burden than flexibility.
Q: What should security teams check in a certificate-based signing workflow?
A: They should check whether the signing certificate is issued after identity validation, whether the private key is protected on secure hardware, and whether revocation is defined for status changes or compromise. Those controls determine whether the signature still reflects real accountability after issuance.
Q: What is the difference between an eSignature and a digital signature?
A: An eSignature is the broader category for signing documents electronically, including clicks, typed names, or drawn signatures. A digital signature is a specific type of eSignature that uses cryptography to verify signer identity and protect document integrity. In practice, digital signatures offer stronger assurance for high-risk documents, while eSignatures cover a wider range of approval scenarios.
Technical breakdown
Why email-based signing is not identity proof
Most basic e-signature tools authenticate a signer by confirming access to an email address. That proves a message recipient can click a link, but it does not prove the person is who they claim to be. In identity terms, the document is trusted because the delivery channel is trusted, not because the signer identity has been strongly verified. That breaks down when a contract, disclosure, or filing needs non-repudiation and durable evidence of authorship. Practical implication: treat inbox access as a low-assurance factor, not as sufficient proof of signer identity. See the IAM and IGA Basics.
Practical implication: Separate document delivery control from signer identity assurance in signing workflows.
How certificate-based signatures bind identity and integrity
A certificate-based digital signature uses a private key under the signer’s control to create a cryptographic binding between the signer identity and the file content. If the document is altered after signing, validation fails. That means the signature carries both identity evidence and tamper evidence, which is why it is stronger than a simple checkbox or emailed link. The value is not just stronger authentication at signing time, but persistent proof that survives document sharing, forwarding, and later dispute. Practical implication: use certificate-backed signing when documents must stand on their own after the session ends. See the Cryptography Basics Guide.
Practical implication: Use certificate-backed signing for documents that need persistent proof of origin and integrity.
Why trusted signing needs lifecycle control, not just issuance
A signing certificate only delivers durable trust if its issuance, storage, and revocation are controlled. If the private key is exposed, reused, or left in circulation after the signer’s status changes, the cryptographic model stops reflecting real-world accountability. That is a lifecycle problem, not a pure PKI problem. For independent professionals and organisations alike, the trust boundary sits around the certificate lifecycle as much as the signing event itself. Practical implication: govern signing certificates as managed identity credentials, not as one-time document features. See the NHI Lifecycle Management Guide.
Practical implication: Manage signing certificates through full lifecycle governance, including revocation and key protection.
Threat narrative
Attacker objective: The objective is to create or validate a document that appears authentic enough to influence a financial, legal, or compliance decision.
- Entry occurs when an attacker or unauthorised user gains control of the email account used as the signing factor, which is enough for many basic e-signature tools to accept the signer.
- Credential access follows because the signing workflow relies on mailbox possession rather than a cryptographically verified identity credential.
- Impact occurs when a forged or disputed document is accepted as authentic, creating legal, financial, or reputational harm for the signer and the recipient.
Breaches seen in the wild
- Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
- Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Email access is not identity assurance: The core failure in everyday signing is that many workflows still equate mailbox control with signer authenticity. That assumption was tolerable for low-risk approvals, but it collapses when documents carry legal or financial consequence. The implication is that trust must move from communication access to cryptographic identity proof.
Certificate-based signing turns the document into its own evidence: The best digital signature is not the one that looks convenient in the inbox, but the one that remains verifiable after forwarding, storage, and dispute. This is where document integrity and signer identity converge into a single control plane. Practitioners should treat the signed file as the durable trust object, not the delivery email.
Professional document trust is a governance problem, not a formatting problem: Independent professionals, firms, and platforms all rely on the same underlying claim: that a signature represents a real person and a stable document state. When identity proofing is weak, the governance gap shows up as dispute risk, not just technical weakness. Audit and regulatory perspectives matter because legal validity, evidentiary value, and operational assurance are now intertwined.
Signing credentials need lifecycle controls because accountability can drift: A signing certificate is only trustworthy while the private key remains under the right person’s control and the credential remains valid for the right use case. If issuance, storage, revocation, and recovery are not governed, the signature can outlive the trust relationship it was meant to represent. The practical conclusion is that document signing must be managed like identity infrastructure, not like a convenience feature.
What this signals
Identity proofing is now part of document governance: As more professional agreements move online, the trust problem shifts from how fast a document can be signed to how reliably the signer can be verified. That makes signature assurance a governance control, not just a workflow preference.
Certificate-backed signing is becoming the practical baseline for records that need to survive scrutiny. When the file itself carries proof of origin and tamper detection, teams can reduce dependency on inbox trust, human recollection, and after-the-fact dispute handling.
Professional signing should be treated like a controlled identity event. The question is no longer whether a signature is electronically valid, but whether it is verifiable enough to support accountability when the document matters.
For practitioners
- Strengthen signer identity proofing Require certificate-backed identity validation for documents that carry legal, financial, or regulatory weight instead of relying on inbox confirmation.
- Separate low-risk approvals from high-assurance signing Allow basic e-signatures only for routine workflows, and reserve cryptographic signatures for contracts, filings, disclosures, and other evidentiary documents.
- Protect signing credentials like identity assets Store private keys on secure hardware, limit who can issue or reuse signing certificates, and define revocation handling before a relationship changes.
- Build dispute-ready document evidence Ensure every signed document can show who signed, what was signed, and whether the file changed after signing without depending on the original email thread.
Key takeaways
- Basic e-signature workflows often prove inbox access rather than signer identity, which leaves a trust gap for important documents.
- Certificate-based signatures add cryptographic proof of authorship and integrity, making documents more defensible after sharing or dispute.
- Practitioners should govern signing credentials as identity assets and reserve high-assurance signing for documents with legal, financial, or regulatory impact.
Related NHI Mgmt Group resources: Ultimate Guide to NHIs: What are Non-Human Identities · NHI Lifecycle Management Guide · IAM and IGA Basics
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Email-only signing proves inbox access, not signer identity, which is the core weakness described here. |
| NHI-02 — Secret Leakage | Signing private keys and certificates must be protected to preserve the trust the signature is meant to represent. | |
| Recommendation — Replace inbox-based signing checks with cryptographic identity validation for high-trust documents. Protect signing keys as sensitive credentials and revoke them quickly if exposure is suspected. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Signing credentials are authenticators whose issuance, storage, and revocation need lifecycle control. |
| Recommendation — Manage document signing credentials with enforced issuance, protection, rotation, and revocation rules. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Signing authority should align with verified identity and scoped authorisation, not simple mailbox access. |
| Recommendation — Limit signing authority to verified identities and scope it to approved document types and use cases. | ||
| ISO/IEC 27001:2022 | A.8.2 — Privileged Access Rights | High-assurance signing credentials function as privileged access and should be tightly governed. |
| Recommendation — Treat signing certificates as privileged credentials and restrict their issuance and use accordingly. | ||
Key terms
- Certificate-Based Digital Signature: A certificate-based digital signature is a cryptographic signature that proves a message or document came from a specific holder of a trusted certificate. It uses a private key to sign and a public certificate to verify identity, integrity, and non-repudiation within public key infrastructure and controlled trust chains.
- Non-Repudiation: Non-repudiation is the ability to prove what an identity did, when it did it, and under what authority. For autonomous agents, that evidence must include context, approvals, and tool usage so later review can reconstruct the decision path.
- Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
- Tamper detection: Tamper detection is the ability to identify unauthorised changes to identity records, policies, or audit data. In identity programmes, it matters because compliance evidence is only useful if the underlying record can be trusted. Detection must be paired with logging, retention, and review so edits are visible and provable.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org