A signature is a claim that a specific person or organisation approved a specific document. That claim is only as good as the exclusivity of the key behind it — and a key in a file is not exclusive to anybody.
PDF signing
Signing a PDF with a hardware key is the common case, because the recipient can see whether the signature verifies and whether the certificate chains to something they trust. Any signer that speaks PKCS#11 will use the device directly; on Windows, the OpenSC minidriver puts the certificate in the Windows certificate store, which is where desktop PDF software looks for it.
Add a timestamp from a time-stamping authority. Without one, the signature becomes unverifiable when the certificate expires; with one, a document signed today still verifies in ten years, which is the whole reason people sign contracts rather than e-mail them.
S/MIME e-mail
S/MIME is the case where hardware pays off quietly. A signing key on a laptop travels with the laptop; a key on a device that has to be plugged in does not leave the building in a stolen bag. Outlook and other desktop clients pick the certificate up from the Windows store, so the setup is the same one you would do for a smart card, because as far as the operating system is concerned that is what this is.
Advanced electronic signatures
Under eIDAS, a signature made with a key under your sole control and a certificate identifying you supports an advanced electronic signature. Sole control is what non-extractable hardware gives you: the key is generated inside the card and no command reads it back out.
Internal approvals, engineering releases, purchase orders, signed reports, code and container artefacts: a key that cannot be copied is the substantive improvement over a certificate in a file.
Where to go next
Document signing is mostly a question of where the certificate lives. See also code signing, the Windows certificate store, or the hardware security module overview and the datasheet.
The KeyNub HSM ships from Munich. Ask us if you want to talk through a deployment first, or order one.
