Digital signatures

Signing with a generated identity

Choose Sign digitally and Colophon can generate a self-signed identity on the spot, with no certificate authority and no paperwork. It signs the document cryptographically using PKCS#7 in a PAdES-style incremental update, so any reader can confirm the file hasn't changed since signing, but because the identity is self-signed, that reader will still flag the signer as untrusted.

Signing with your own certificate

If you already have a signing certificate, a .p12 or .pfx file from a certificate authority, import it instead, and Colophon stores it in your device's Keychain for one-tap signing afterward. An imported identity is trusted wherever its issuer is trusted, the same as any certificate-backed signature.

Co-signing

A document that's already signed doesn't have to stay that way: co-signing, or adding a second digital signature, doesn't invalidate the first one. Multiple signers can each add their own signature to the same file, in sequence.

Trusted timestamps

A signature proves the file hasn't changed, but on its own it can't prove when it was signed — which matters once the signing certificate expires. So after signing, Colophon requests a trusted timestamp from a timestamping authority (an RFC 3161 service, freeTSA.org by default) and embeds it in the document. Only a hash of the signature is sent, over HTTPS — never the document itself.

Timestamping is best-effort: if you're offline, the signature still applies and Colophon tells you it isn't timestamped, and there's a standalone Add trusted timestamp action to add one later. When you verify a timestamped document, Colophon shows the trusted time and says plainly if the authority that issued it isn't trusted.