How to Spoof PDF Signatures
Cool. So it seems like PDF signatures are broken by design, not just implementation. If you can just append unsigned content to a signed PDF, you are toast.<p>Interestingly, Adobe has created a cottage industry of certificate providers and has strict security requirements like use of HSMs to prevent private keys from being exposed. As you can imagine, these certificates are stupidly expensive for what they do.