Paper processes are a normal part of person to person exchanges, and like the written signature, we can be sure their use will not disappear overnight. This means it is even more important that we evolve the relationship between our physical and digital experiences that involve paper so they can work more fluidly.

Sometimes these exchanges begin as a physical interaction and transition to the digital but almost always, it is the digital embodiment of that transaction that is relied upon once the exchange ends. This is because these digital representations make it possible to instantly access the data contained in them and correlate it to other data enabling quicker and better decisions.

This is particularly important to keep in mind when we consider that paper based workflows are, broadly speaking, privacy preserving workflows. Only those people who have physical access to the associated documents have knowledge of their contents. Their physical nature also makes it possible for those who have possession to freely review these documents with others. This is not true of most digital workflows where the records are commonly stored in clear text in some database or cloud storage service.

There is also a long history of effective independent forensic analysis of paper documents and written signatures. While there are certainly many things that can be determined from forensic analysis of a digital document, attributing it to an individual, or detecting that it has been tampered with is often next to impossible.

It is possible to provide these same properties with digital documents and do so with even greater assurances with the intelligent application of cryptographic based signatures and encryption.  Despite this, these approaches are seldom used, the primary reason given by vendors is providing them requires investment in complex key management solutions and often results in sub optimal user experiences.

Those that do offer cryptographic signatures seldom use them to represent the signer’s intent and instead rely on digital facsimiles of the signer’s physical signature. They then notarize that they saw a given ip address, at a given time attach that facsimile of a signature. This technically exceeds the legal minimum requirements in the United States but fails to meet the minimum expectations most other countries mandate for electronic signatures.

Even once you design a solution that achieves all these properties you are not done providing an equivalent digital alternative. These person-to-person exchanges often require both paper and digital artifacts and as a result you will need to be able to link the two together. This is not too dissimilar than how an “original” contract with its ink signature is often treated as the authentic “source of truth”. In these hybrid digital and physical interactions one party may have processes or compliance requirements that require a paper representation (and something that approximates a physical signature) of the interaction. while the others involved may prefer the convenience of the digital representation.

So what are the things you minimally need to look for in a digital signature solution beyond usability if it is to deliver the same or better properties as existing paper based solution?

• Each signer:
  • cryptographically signs the document;
  • attaches a facsimile of their physical signature to the document.
• The final document:
  • is cryptographically notarized with metadata about the signing;
  • includes a timestamp and the cryptographic metadata needed to verify the signature long into the future;
  • can be encrypted end-to-end ensuring only the parties associated with of the document can read it;
  • is assigned a unique identifier that is placed plainly in the document so when it printed its digital embodiment can be easily found;
  • includes a log of activities that took place during the signing process;
  • is archived so it can easily be retrieve later in case of a dispute.
• The document and signature formats used are based on broadly accepted standards so:
  • it will be readable and verifiable far into the future;
  • it can be read and verified in third-party applications;
  • enforcing the agreement does not require participation of the solution provider in case of dispute.
• A free web based reader is available that:
  • does not require registering to read the document;
  • enables participants to share the documents with others;
  • can validate the signatures without the need for plug-ins or desktop applications;
  • works as well on mobile and tablet as it does on the desktop;
  • can be easily and freely integrated into your own applications.
• An API that makes it possible to integrate into your own applications the signing of:
  • documents;
  • web forms.

With these bases covered you have something that should be able to withhold the test-of-time just as paper processes have been able to do.