You are missing some basic conceptual knowledge about how digital certificates, signatures, and PKI works. I work with these concepts daily as someone working in the IT Security profession, so let me explain.
Digital signatures are used to protect the Integrity principle of information (I in CIA triad) along with the related principle of non - repudiation. Integrity of information means:
Data is not maliciously modified / destroyed / corrupted while either at rest or in transit
The related principle of non - repudiation ensures that if integrity principle has been violated, the accountable party cannot deny having tampered with the data.
PKI is a asymmetric method of signing / encrypting data, which means that 2 keys are needed to complete the operation:
- Private key only known to one party in the transaction
- Public key of each party in the transaction that is freely available
Signing a Message
When signing a message, the message digest of the message body is first generated by running the message through a hashing algorithm such as SHA2. The private key of the sender is then used to encrypt the transmitted message digest. The public key of the sender is often appended to the message body. Upon receiving the message, the receiver decrypts the message digest using the freely available public key of the sender. By comparing the decrypted message digest with a separately computed hash of the original message, integrity and non - repudiation can be assured if the two resulting hashes are equal.
Non - repudiation is assured via the role of the Certificate Authority (CA). The role of this party is to attest to the identity of each party in the transaction (sender and receiver) by binding the pubic key of each party to a document known as a certificate that contains information such as the origination domain, and method used to generate the keys.
Encrypting a Message
The purpose of encrypting a message is to ensure the C and I in CIA - Confidentiality and Integrity. Encryption (ex: via TLS) ensures that data in transit only cannot be intercepted by a malicious 3rd party.
Data is encrypted with the public key of the receiver so that only the matching private key of the receiver can decrypt the message.
To answer your question, The private key is known only to the receiver and is NOT in the certificate