I have generated a private/public key pair using gpg.
Can I use this key pair to digitally sign a PDF without a digital certificate, but to still have the signature integrated into the PDF, instead of creating a separate signature file?
To clear things up, instead of using paper and written signatures, I want to use legally binding electronic documents, but am wondering if this can be done without resorting to certification by a CA or digital certificates altogether.
I understand that there is a difference between an electronic signature and a digital signature, but it seems to me that the EU law doesn't really recognize this difference.
Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures defines "electronic signature" as "data in electronic form which are attached to or logically associated with other electronic data and which serve as a method of authentication." The EU differentiates between an electronic signature and advanced electronic signature. However, it seems that electronic signatures still have legal strength:
Member States shall ensure that an electronic signature is not denied legal effectiveness and admissibility as evidence in legal proceedings solely on the grounds that it is:
in electronic form, or
not based upon a qualified certificate, or
not based upon a qualified certificate issued by an accredited certification-service-provider, or
not created by a secure signature-creation device.
The first problem is that I'm not sure whether this means that a scan of a signed piece of paper has legal strength or if it refers to what I'm trying to accomplish. That is -- to sign a PDF with a private key with my name on it and attach my public key to it, but all within the PDF file.
Is latter even possible? Can I sign a PDF using my key pair without resorting to certification from CA? Would I need to create my own digital certificate or can it be done without certificates altogether? If I had to create a certificate, how would I create it using my existing key pair? You can create certificates using Microsoft Office, but it seems that this just generate another set of keys. You're never prompted to input your existing keys.
Furthermore, it seems to me that creating your own certificate could categorize you as a certificate-provider and thus subject to some stricter legal requirements, which is why I want to avoid certificates altogether.