feat: blog article building documenso part 2

apps/marketing/content/blog/building-documenso-pt2.mdx

@@ -0,0 +1,113 @@
+---
+title: 'Building Documenso — Part 2: Signature Validity'
+description: It's a signature valid? And what does that mean? It's a suprisingly complex question, let's take a look.
+authorName: 'Timur Ercan'
+authorImage: '/blog/blog-author-timur.jpeg'
+authorRole: 'Co-Founder'
+date: 2024-04-05
+tags:
+  - Document Signature
+  - Certificates
+  - Signing
+---
+
+<figure>
+  <MdxNextImage
+    src="/blog/eu-validate-1.png"
+    width="650"
+    height="650"
+    alt="A report card for signature validity"
+  />
+
+  <figcaption className="text-center">
+    If a tree does not comply with the EU trust list, does it make a sound when validating?
+  </figcaption>
+</figure>
+
+> TLDR; Signatures can be valid and compliant for different signature levels, even if some validators show errors for higher levels. Not all useful security measures are mandated by law.
+
+# A valid question
+
+A few days ago, an early adopter brought up this question in our [Discord](https://documen.so/discord):
+
+<figure>
+  <MdxNextImage
+    src="/blog/eu-validate-2.png"
+    width="650"
+    height="650"
+    alt="A report card for signature validity"
+  />
+
+  <figcaption className="text-center">
+    You can check out the validator here: [https://documen.so/eu-validator](https://documen.so/eu-validator)
+  </figcaption>
+</figure>
+
+For those unfamiliar with the tool, he used the validator tool of the EU's Digital Signature Service (DSS) Framework to check the signature of a document signed with Documenso. The EU provides this tool to help users and providers check the validity level of their signatures.
+
+A short refresher from [Building Documenso — Part 1: Certificates](https://documen.so/certs):
+
+> Documenso inserts all visual signatures into the document and then seals it using the "Documenso Inc." corporate certificate. This makes the resulting PDF document tamper-proof and guarantees it hasn’t changed since signing.
+
+Before we answer if the document was signed correctly, we need to understand what the goal was.
+
+There are 3 signatures level in the europeas eIDAS regulation:
+
+1. **Simple Electronic Signatures (Level 1/ SES):** Just a visual signature or even a checkbox on a document.
+
+2. **Advanded Electronic Signatures (Level 1/ SES)**: An actual crypographic signature (not just a seal on the whole document, but a specific signature), using a certificate linked to the identification data of the signer.
+
+3. **Qualified Electronic Signatures (Level 1/ SES):** Same as 2. but done by a government certified entity on certified hardware and after identifying the signer with an official ID document (e.g. passport)
+
+> 💡 Side Note: Number 2 is how most people imagine digital signatures. But most of the market uses 1. plus a seal on the whole document under the name of the signing provider (e.g. Documenso). The signers data is only inserted visually, not in the actual signature. Why? One of the reasons is, that it's much easier and without a readily availible open source framework to draw from it is quite tricky to build. This is something we aim to build (which many have done) and open source (which no one has done).
+
+From the perspective of eIDAS, Documenso offers Level 1/ SES signatures, since it does not adhere to all of the requirements of AES. This means that, technically, there is no legal need to seal the document to achieve this level of validity. We do it anyway since it improves the level of confidence users can have in the signed document. Sealing the document, even though not legally required, is a great example of Documenso’s approach to signatures. First we aim to provide all legal requirements for a given use case. Then we add any protection that can be added without unwarranted friction to the creation of the signature.
+
+## Not if valid, but how valid
+
+**Q: So, is the signature in the image invalid?**
+
+A: No, it isn’t
+
+**Q: Then why does it say "Unable to build a certificate chain up to a trusted list"**
+
+A: The certificate we use to seal the document after inserting the signatures is not on the EU Trust list
+
+**Q: Does that mean it is less secure?**
+
+A: No, it means the provider (Wisekey) is not on a list maintained by the EU. The cryptographic signature is just as strong as any other
+
+For someone who does not deal with this stuff daily, this can be hard to comprehend. Whether you use a certificate you generated yourself, one generated by a Certificate Authority (CA) like Wisekey, or one by another on the EU trust list (e.g., Bundesdruckerei), the cryptographic security guaranteeing that the document has not been tampered with is always the same. Many providers like Documenso, DocuSign, PandaDoc, and Digisigner all use this method for their regular plans. The mean, if you were to run a document signed by them through the validator above, the result would be the same (The sigaure format may vary though). The interesting question is why?
+
+## Certificate Infrastructure is broken
+
+While there are some actual expenses involved in providing AES and QES, that blunt reality is, it's just good business to charge for them per signature, almost no one has the ressources to set this up themselves. While this initial process of becoming an QES certified is really expensive, selling the certificates afterward is very lucrative. This leads less innovation in the space and only big player providing these high-compliances services. Even certificates only used to seal documents without being QES certified are sold for a big range of prices, while they cost almost nothing to produce.
+
+## Why Though?
+
+**Q: Is the cryptographic security the same, why do people buy a certificate for money and not just generate one themselves**
+
+A: Self-generated certificates are not recognized for higher-level compliance signatures like QES
+
+**Q: So if you don’t need higher-level signatures, you could just generate one yourself?**
+
+A: Yes, you could. Since eIDAS Level 1 does not require a cert, you could use your own
+
+**Q: Why don’t more people?**
+
+A: One reason is that apart from the EU trust list, there are others, like the Adobe trust list. While not legally required, being on that one (like Wisekey) gives you a green checkmark in Adobe PDF, which is how most people check signature validity.
+
+**Q: Not a question, but all of this sounds weird**
+
+A: It’s is. This is one of the reasons why Documenso exists. We plan to make this easier.
+
+**Q: How?**
+
+A: By explaining and providing easy-to-use tools and eventually free, highly compliant signature certificates for everyone.
+
+Eventually, we plan to start a free certificate authority called Let's Sign, named after another instituion that broke the paid certificate paradigm to the benefit of the internet: [Let's Encrypt](https://letsencrypt.org/).
+
+As always, feel free to connect on [Twitter / X](https://twitter.com/eltimuro) (DM open) or [Discord](https://documen.so/discord) if you have any questions or comments.
+
+Best from Hamburg\
+Timur