We built a thing! I spent the past few months building Trusted Signatures, a SaaS product that makes it easy to provide durable signed PDFs at scale.
This makes it easy to prove documents came from who they’re supposed to, unaltered.
- ✅ AATL and eIDAS compatible signatures (Adobe Reader green check ✅)
- ✅ Detached CMS support — send only the SHA-256 hash, keep your files local
- ✅ Accessible via HMAC API key
- ✅ No full-PDF uploads — just clean cryptography
Perfect for building secure workflows for finance, legal, or compliance — or if you’ve ever wanted a programmable signature API you can actually trust.
like this
𝕕𝕚𝕒𝕟𝕒 🏳️⚧️🦋 reshared this.
Brad Koehn ☑️
in reply to Brad Koehn ☑️ • • •Trusted Signatures
Trusted SignaturesHank G ☑️
in reply to Brad Koehn ☑️ • • •like this
Brad Koehn ☑️ and Griff Ferrell like this.
Greg A. Woods
in reply to Brad Koehn ☑️ • • •Brad Koehn ☑️
in reply to Brad Koehn ☑️ • • •It turns out the maintaining an OV certificate (needed for signing PDFs) is extremely tedious. You need to create the private key in an HSM (which cost thousands of dollars) and the security protocols required to keep the certificates safe are very onerous. Add to that Timestamp Authorities, CMS creation and maintenance, and the whole thing becomes an expensive hassle. Outsourcing this complexity to a specialist makes a ton of sense.
The value proposition of our business is that we manage these complexities for you at a price so low that it makes no sense to try to do it in house. While the protocols are open and you certainly can DIY, there's no way you can build and maintain this service for less than we can.
Karl Auerbach
in reply to Brad Koehn ☑️ • • •This sounds interesting (I bet my patent counsel would be interested as well).
I did not notice a link to the project - did I miss it? Could you give me a pointer?
(Now we just need something to better identify legit Docusigns. - I've gotten so many fake ones of those in the last few months.)
Griff Ferrell likes this.
Brad Koehn ☑️
in reply to Brad Koehn ☑️ • • •@Karl Auerbach trusted-signatures.com
Yeah, DocuSign has a bunch of challenges, sender authentication being one. Another is that after everyone has signed, it signs the PDF with its own certificate, which can tell you if the document was modified but not where it came from.
We're looking at solving problems like this as a supply chain issue; it turns out there's a lot of fraud involving doctored PDFs.
For example, if someone sends you an invoice against a valid PO, but they've put in their own account for payment, you're out the money. But if you only accept signed PDFs, you (or better: your systems) can immediately validate that the invoice actually came from the correct source, unmodified.
Another common problem area is real estate fraud: documents pour in from all over the place (appraisals, inspections, bank statements) and people try to put forward fraudulent ones all the time. If they were signed, then the risk of fraud drops precipitously, and even if there is fraud, the senders cannot repudiate the documents and are still on the hook.
We make it so cheap (our price per PDF quickly approach $0.001 per PDF) that there's no reason not to sign everything your organization sends, and to require the companies sending you PDFs to sign theirs.
Avoiding a single loss or lawsuit will cover the cost a thousandfold.
Griff Ferrell likes this.
Karl Auerbach
in reply to Brad Koehn ☑️ • • •like this
Griff Ferrell and Brad Koehn ☑️ like this.