I'm treading into the murky waters of electronic document signatures, and I'm having trouble figuring out the right approach to deal with my requirements. I think this should be pretty straightforward, but endless searching has left me with no concrete examples.
I am building a platform (imagine an Uber-type model) for matching clients with professional service providers. At the end of the services being provided, the service provider needs to send a document (a PDF) to the client for a signature. We want to let the client electronically sign the document, and here's where things become unclear. We need these signatures to be legally binding, but it isn't clear to what lengths we need to go to get to that point.
Clients in this system will have to create a login and authenticate with our system before they can sign anything. Therefore, we know who they are when they go to sign. Some things that I have read suggest that having the user declare (check a box, type their name, etc.) something like the following would be enough: "I agree to blah, blah, blah, and I intend to convey the same significance to this electronic signature as I would to a physical signature". We could then stamp the document with a signature-looking text and be done with it.
Other extremes seem to be to electronically sign the PDF itself using PKI, requiring public/private keys for each user. Due to libraries (un)available in my technology stack, it's unlikely that I will be able to digitally sign the actual PDFs.
I thought maybe a middle ground would be to do asymmetric encryption on the document at the time of "signing", and store the signed document at that point. That way, we could later verify that the document was unaltered if it ever comes into question. However, this approach would also require public/private key pairs for each client, and we are not prepared to require our users to generate their own. Would it then be appropriate for us to generate pairs for each user, storing them on our own server and/or in our own database (along with their other user information)? Does this really get us any better security than we had just by having users log in?
I would really appreciate any insight here. Unfortunately, most documentation out there is from DocuSign or other vendors trying to sell their services. Obviously it would be a big relief to just use that, but the cost is exorbitant given the model we have (most charge per user).
UPDATE: This service will be US-based only for the foreseeable future (if that changes anything)
UPDATE: I see a related question (Digital signatures and truly validating what was actually agreed to) that talks about a similar problem. Basically responses there confirm my fear that yes, it might be invalid for me to maintain private keys for my users. In that case, how are other electronic signature providers (including DocuSign, HelloSign, etc.) able to provide this capability without their users needing to know about private keys?