Multiple Signatures and unable to save more then once

It's a pity in a way that "signatures" was the name chosen for this PDF idea. Yes, it has ideas in common with scribbled signatures on paper, but many things are very different, and the name leads people into false ideas of similarity.

It isn't helped when Adobe keep adding new ideas of "signatures" to PDF so it's hard to keep track of what you get. But there are two basic things: digital signatures and electronic signatures are this week's names.

Electronic signatures are an exact match for scribbled paper signatures. The signature might be scribbled on a pad, read with a scanner or taken from a file. It might be just a written name or might include other info like a date, making it more like a stamp. These are good when the final product is printed paper, but they have little legal status and no safety as they are trivial to fake.

Digital signatures are very different. They are more like a seal over the whole document. They have some legal status in some countries. Their job is two fold

1. Know if the document was edited. You can't stop a document from being edited (or faked) in the real world, but the signature includes enough info to KNOW IT HAPPENED. So it can settle contract disputes of the "you edited the contract we sent you" variety.

2. Know who signed it the document, based on information in a certificate. Well, actually what you can do is verify that a particular certificate was used to sign it (this can't be faked). The certificate might prove someone is who they say they are, but this is a complex area, based on who you trust to make certificates. Adobe-issued digital IDs are no proof of identity at all.

There is a third thing digital signatures can do, and this is arguably a Very Bad Thing. They can put a mark on a page to say the document is signed. I consider this a Bad Thing for two key reasons

(a) because the mark is on one page, people often assume the page is signed rather than the document, and head off into the dangerous territory of "signing every page" even though that means nothing and can cause major problems.

(b) people get in the habit of "looking for the mark" to prove a file has been signed. But the mark on the page means NOTHING: it could be faked in seconds. People must have the habit of validating the actual certificate, and need specific training to do this non-obvious thing.

Multiple digital signatures are sometimes needed when more than one person or entity must prove authenticity. But signing more than once as the same person can be disastrous. There is a high overhead on each signature, because in effect it wraps up the whole file. So using the file involved going through more and more wrappers. After some low, unknown, number, a limit is reached: maybe one or two dozen signatures per file will be as many as can work and this WILL CHANGE WITH OTHER SOFTWARE. We have heard from people who have "signed every page" then are hit by a lower limit, and their files are all now useless!

People and organizations in transition from paper sometimes need both kinds of signature: a scribble and a certificate. Never give into the temptation to use the mark from digital signatures to do this! Stamp or use electronic signatures FIRST and ONLY THEN use a single digital certificate.