When the CA issues the certificate, they sign it using their private key. Only the CA's public key can verify that the signature is authentic and the certificate has not been tampered with.
What is odd is that the signature property seems to be missing in a lot of instances (.NET's X509Certificate class and when viewing a certificate in Windows). I've found that even though it is not always displayed, it is still inside the certificate. Given a certificate in DER binary format, you can decode it into plain text which DOES show the signer's signature.
openssl x509 -text -noout -inform DER -in certFile.der
Signature Algorithm: sha1WithRSAEncryption
To validate this certificate, one needs a second certificate that
matches the Issuer (Thawte Server CA) of the first certificate. First,
one verifies that the second certificate is of a CA kind; that is,
that it can be used to issue other certificates. This is done by
inspecting a value of the CA attribute in the X509v3 extension
section. Then the RSA public key from the CA certificate is used to
decode the signature on the first certificate to obtain a MD5 hash,
which must match an actual MD5 hash computed over the rest of the