California Secretary of State Approved List of Digital Signature Certification Authorities

AB2296 allows us to use and accept "electronic signatures".

California Government Code Section 16.5:

(e) Nothing in this section shall limit the right of a public entity or government agency to use and accept an "electronic signature" as defined in subdivision (h) of Section 1633.2 of the Civil Code.

Digital signatures is a subset of electronic signatures but we don't have to use those.  If we did, we need to use the California Secretary of State Approved List of Digital Signature Certification Authorities.  Fortunately, we can just use the simplier electronic signatures.

That's an awfully small list of CAs, among all the CAs in business. And there is no guarantee that some of them will appear in the Acrobat Trust Lists, so those signatures won't be valid by default when opened by Acrobat. That's a problem when political entities take it upon themselves to issue these types of regulations without a background in PKI and Digital Signatures. In general, I would think that individual Certificate Authorities wouldn't be interested in going around to every small political entity to register their CA as valid. But that's for them to decide.

Note that AdobeSign only Certifies documents, and doesn't Sign them as an individual signer (yes, it's the same PKI, but the Certifying signature is not signing by a person, e.g. signatory). Any individual signer would need to get a certificate from one of the 4 CAs that issue certificates that are accepted by California. That cuts out a lot of EU CAs, and cloud signing CAs, but that's California's business.