I am developing an application and part of signing up requires a user to sign a contract agreement of using the service.
I have been reading around the subject for a few days, and I am fairly happy with all the techniques around digitally signing a document. Some references below
The one open question I have is how can we truly validate that the data/contract that I present to the user for review is the same as the data/contract that has been signed?
I could show the user a completely different data/contract to what is required, then in the backend of my application, sign the correct data. I can then remove the malicious code. If anyone audited my software as a contract was in dispute, they would see I display the correct data/contract and therefore the questionable contract is binding.
I ultimately have control over all aspects of the signing, so really struggling to understand how anything can be more secure than taking my word as a provider that I will not alter the data/contract that is shown to the user.
So with all the security around actually signing the document, it still ultimately comes down to the trust in me as a developer to not maliciously alter the contractual agreement shown to the user.
Have I missed something in my research? Or does it truly come down to trust? In which case why bother digitally signing at all?
UPDATE Based on answer below:
I control the signing process and what i choose to display on the page. I could show a user Document A on the webpage. They click the 'sign now' button. Document B is used in backend and signed. I send user document B via email. They dispute it. They have no way of proving they saw document A as it was displayed on a webpage which I have now removed and replaced with document B. Unless a user is really savvy and hashes the webpage themselves or take a screen capture (most users wouldn't). How can they prove they agreed to document A?
UPDATE Based on accepted answer:
For anyone reading this and also struggling, the one thing I really overlooked here is that I assumed that I could be the keeper of my private key and my customers private key. In hindsight this is obviously just plane wrong. The only way to truly apply a digital signature is to allow both parties to sign with their own private key, and then provide their public key to allow validation of the signature. The problem with this is obviously that many non tech savvy users just wouldn't really know much about digital signatures and how to apply them, so I've had to admit to defeat and downgrade to plain old electronic signature with some SHA256 hashing to 'seal' it after signing.