I have been thinking about digitally signed documents (Word files and PDF files) and can not get over the fact about - how can I securely know when the file was signed?
Scenario: If the date of the signature is saved in the file that I am signing. The voucher for the date is me. However, if someone steals my private key, and I revoke my Certificate, the thief can easily create a PDF file with a false date and sign that with my revoked key. The document will appear as being signed at the time, when my Certificate hasn't been revoked yet.
The only way I can think of to implement the signature date safely is by sending my signature to a "trusted" time server, which timestamps my signature and signs it. So in fact - I need a digitally signed document which vouches about the time of my signature.
Does Adobe just take Computer time, or does it get time from the Adobe server, or does it receive an Adobe-signed vouch for time?
Is there another - simpler way?