This article explains the purpose of Seals, Timestamps and Trust Service Providers for documents signed electronically through Penneo Sign, and it links to more in-depth articles on the different topics.
- Qualified Electronic Seal
- Qualified Electronic Timestamp
- Qualified Trust Service Providers (QTSP)
- QTSPs in Penneo Sign
- Validity and Subtle Differences
Qualified Electronic Seal
Penneo’s Qualified Electronic Seal is applied to all documents signed via Penneo Sign. This is to guarantee the integrity of the document. If the content of the document or its signatures are tampered with, then the seal can no longer be validated.
Qualified Electronic Timestamp
A Qualified Electronic Timestamp is applied to all Advanced and Qualified Electronic Signatures created through Penneo Sign. The Qualified Electronic Timestamp binds the documents to the date and time of each signature and ensures that the signatures can also be validated.
Similarly, a Qualified Electronic Timestamp is also used when Penneo’s Qualified Electronic Seal is applied to the signed document.
More information can be found here:
Electronic Seals: Use Cases & Benefits
Verifying the validity of digital signatures
Qualified Trust Service Providers (QTSP)
Qualified Electronic Seals and Qualified Timestamps are exclusively provided by Qualified Trust Service Providers. These are companies that are certified by independent auditors to meet the requirements of the applicable legislation, Regulation (EU) No 910/2014 (”eIDAS”) and technical standards for the services.
Each QTSP is also approved by its national supervisory body. Penneo has been approved by the Danish Agency for Digital Government (Digitaliseringsstyrelsen).
More information can be found here:
What Are Qualified Trust Service Providers (QTSP)?
QTSPs in Penneo Sign
Since 24th February 2021, Penneo has used Intesi Group as provider for Qualified Electronic Seal and Qualified Timestamps.
After becoming certified as a Qualified Trust Service Provider, Penneo also provides these services ourselves, starting from May 2025.
To ensure the highest availability of Penneo Sign, Intesi Group might still be used as a provider beyond May 2025, alongside Penneo’s own service.
Validity and Subtle Differences
Documents signed via Penneo Sign are equally valid regardless of which provider is used, since all Qualified Trust Service Providers are certified by independent auditors according to the same regulations and technical standards. However, a couple of subtle differences can be observed.
Below we show an example from Adobe Reader. We use Adobe Reader as an example, because it is a widely used PDF viewer and available for free.
Adobe Reader example
For seals provided by Intesi, the blue banner states: “Certified by Penneo A/S, certificate issued by Intesi Group”.
For seals provided by Penneo, the blue banner declares: “Signed and all signatures are valid”.
Details of the Seal are visible when opening the Signature Panel through the button in the banner.
The Signature Panel only provides details about the document seal. Information and technical evidence of each signer’s signature can be found in the “attachments” section.
This is further explained in our article Electronic Signature & Electronic Seal Standards.
Technical Standards and Validation Tools
Documents with a Seal provided by Penneo follow the PAdES standard, specifically the PAdES-Baseline-LT level, as defined by the European Telecommunications Standards Institute (ETSI). When the Seal is provided by Intesi, the document adheres to the PKCS7-T format (interoperable with the PAdES-Baseline-T level).
The -T level is sometimes described as “full PDF”, whereas the -LT level is referred to as “partial PDF”. The -LT level is considered a higher level, since it increases the capabilities for technical validation of documents and signatures. Nonetheless, both levels are widely recognised.
The validation results are identical when using the Penneo Validator.
Other tools for document and signature validation will show minor differences (such as the EU DSS Validator, as illustrated below), but their overall validation result is the same for all Penneo documents irrespective of the Seal provider.
Document with a Intesi seals:
Document with a Penneo seal: