Digital Signatures - how to prevent anyone from using my name

Question

I've created a bunch of forms that have digital signatures enabled.  When I've created one either with the PKCS or the Windows Certificate, what's to prevent anyone else from just typing my name, email address and Company Name?  Yes, I can create one and save it with a password, but anyone can do that.  I'm confused how I can ask our users to use digital signatures on internal documents, then have them email to accounting or HR, yet there's nothing to prevent anyone from using anyone else's name (ie how can I prove that it wasn't me that signed it)? 
Is there nothing that's tied to Windows ie I can't use my login ID on our domain unless I use my network password?  That's really the ONLY way I can prove I'm me. 

Answer 1

Self-signed digital signatures are precisely that - the person creating them is the only one attesting to the contents, so you can make a perfectly-valid self-signed ID for Canta Claus of you want to. The critical thing to remember is that a self-signed ID will only validate if the recipient has your keyfile to compare it to. On your own machine it will show as valid because the key is present, but if you send the PDF to anyone else it will show as invalid unless you have separately transferred them a copy of your keyfile. It's that second file which tells them the ID is really yours, as they can physically check where it came from (e.g. by phoning you up). The recipient would then have to manually add the keyfile to the trusted list in Acrobat or Adobe Reader, and finally your PDF signature will get the green tick.
Self-signed IDs are find for internal company workflows as everyone can share their keyfiles, and the IT department can manage what's going on. If you're using digital IDs in a public setting you should never use self-signed certificates, instead you should purchase an ID from a Certificate Authority - a company whose IDs are tied to the 'root certificates' embedded in Acrobat and Adobe Reader. The CA will require proof of identity before selling you the cert, and so anyone can verify it's genuine without needing to contact you. CAS-issued certs for signing PDF files are not cheap, there are several vendors out there and I won't comment on which may be better.