Suppose I have to sign a PDF form. If I'm using (say) Acrobat Reader and a hardware security token, at some point I will be prompted for a PIN to authorize the token to sign the document.
How can I be sure that the document which is being sent for signature to the token is the same document that is being displayed to me?
If my copy of Reader, or some part of the communication channel between Reader and the token is compromised, it seems to me that I might end up signing anything at all.
It seems to me that for not to be spoofed in this way I need a whole system, including the OS and the document display client to be trustable. A general purpose computer will not do.
I would appreciate any pointers towards actually existing devices or research towards solving this problem