Digital signatures and identity proofing: what changes for practitioners?

TL;DR: Sectigo argues that most e-signature tools still verify only email access, leaving professionals exposed as digital forgeries rise 244% year-over-year and now make up 57% of global document fraud, while U.S. consumers lost $47 billion to identity fraud. Email-based signing cannot prove who signed, what was signed, or whether the file changed after signing; cryptographic binding is the decisive control.

Editorial analysis by NHI Mgmt Group, based on content published by Sectigo: “Unlocking Trust Behind Every Professional Signature”.

By the numbers:

• Digital forgeries are up 244% year-over-year.
• Digital forgeries now account for 57% of all document fraud globally.
• U.S. consumers lost $47 billion to identity fraud in a single year.

Key questions

Q: How should enterprises decide when an eSignature is enough?

A: Use an eSignature when the transaction is low risk, the main need is to capture approval, and the business can tolerate lighter identity assurance.

Q: Why do multiple eSignature tools create operational risk?

A: Multiple tools fragment support, evidence, branding, and integration logic across the same transaction model.

Q: What should security teams check in a certificate-based signing workflow?

A: They should check whether the signing certificate is issued after identity validation, whether the private key is protected on secure hardware, and whether revocation is defined for status changes or compromise.

Practitioner guidance

• Strengthen signer identity proofing Require certificate-backed identity validation for documents that carry legal, financial, or regulatory weight instead of relying on inbox confirmation.
• Separate low-risk approvals from high-assurance signing Allow basic e-signatures only for routine workflows, and reserve cryptographic signatures for contracts, filings, disclosures, and other evidentiary documents.
• Protect signing credentials like identity assets Store private keys on secure hardware, limit who can issue or reuse signing certificates, and define revocation handling before a relationship changes.

Bottom line: Basic e-signature workflows often prove inbox access rather than signer identity, which leaves a trust gap for important documents.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →