Why your signature needs a third party’s clock

A digital signature proves who signed and that the document hasn’t changed. The date is a separate matter, and it is the one people argue about: was it signed before the deadline, was the certificate still valid that day, did the agreement exist when someone says it did?

Your computer’s clock doesn’t count

Sign without a timestamp and the time recorded in the signature comes from your own machine. Change the system clock and you can sign “yesterday” or “next month”, and nobody receiving the document can tell.

Validators treat it accordingly. Adobe Acrobat’s help separates a signature whose time comes from the clock on the signer’s computer from one timestamped by a server you trust. They aren’t presented the same way, because they don’t prove the same thing.

What a timestamping authority does

A timestamping authority (TSA) is a third party that receives a fingerprint of what you signed — never the document itself — and returns a token, signed by the TSA, with the date and time. The EU’s eIDAS Regulation defines an electronic time stamp in Article 3(33) as data binding other data to a particular time and proving that the latter existed at that time. The protocol is profiled in ETSI EN 319 422, on top of RFC 3161.

With the timestamp in place, the signature moves from PAdES B-B to B-T. The levels are compared in B-B, B-T, B-LT, B-LTA: which PAdES level do you need?

Qualified timestamps carry a presumption

Not every TSA is equal in law. Under Article 41 of eIDAS, no timestamp may be denied legal effect just because it is electronic — but qualified timestamps enjoy a presumption of the accuracy of the date and time they indicate, and of the integrity of the data they are bound to. Article 42 sets the requirements: bind the time to the data so it can’t be changed undetectably, rely on a time source linked to Coordinated Universal Time, and be signed or sealed by the qualified provider. The 2024 amendment, Regulation (EU) 2024/1183, adjusted both articles but left that presumption and those requirements as they were.

Whether a provider is qualified isn’t the provider’s claim to make: it is in its country’s trusted list. The European Commission gathers every member state’s list in its trusted list browser.

A qualified authority that is free for personal use

The ACCV (Agencia de Tecnología y Certificación Electrónica) is a Spanish qualified trust service provider. In Spain’s trusted list its timestamping services are listed as qualified, with status granted: we checked the list itself, and anyone can do the same in the Commission’s browser.

The ACCV offers the service free for personal use by individuals, and through two paid plans for professional use by companies and public bodies. That is what its own service page says.

If you sign for work, the ACCV asks you to take out a contract: it then gives you a username and password, which you can enter in PDFsigna’s Settings next to the timestamp server address, or the address of any other qualified timestamping authority you already pay for.

Which is why the Free plan signs in B-T

A signature without a timestamp is cheaper to make, but it leaves open the question people argue about most. With a qualified authority available that is free for individuals, there was no reason for PDFsigna’s Free plan to sign without one: it signs in PAdES B-T, timestamped by the ACCV’s public TSA.

Only the cryptographic fingerprint of what you sign goes to the TSA, never the document. Offline, you can still sign, without a timestamp, and the app tells you so.

This article is general information, not professional advice. Laws, prices and how software works change over time: before you decide, check the official, up-to-date documentation from each authority or vendor.