eSGN

Remote onboarding, contract exchange, and cross-border transactions have made electronic signing essential, but regulatory requirements (notably eIDAS) often force multi-step, multi-channel processes that slow business and harm user experience. eIDAS defines requirements for electronic identification and trust services across the EU. Advanced electronic signatures (AES) require unique identification of the signatory, a signature linked to that signatory, sole control of the private key, and tamper evidence via signature invalidation if a document changes. Qualified electronic signatures (QES) provide the highest assurance and the same legal standing as handwritten signatures; they add safeguards such as a qualified certificate stored on a qualified signature creation device (QSCD) and must be issued by qualified trust service providers listed on the EU Trust List.

Digidentity (founded 2008, headquartered in The Hague) provides eSGN, combining remote identity verification and a virtual smart card to enable AES/QES in a single self-service digital flow, with immediate ability to sign after onboarding. Identity verification relies on NFC-enabled, ICAO-compliant passports and ID cards by scanning the machine-readable zone (MRZ) and reading the embedded chip. Liveness and 1:1 face matching are performed via selfie compared to the ID photo, supported by BioID’s spoofing and deepfake checks, without needing a 3D camera and without sharing personal identity information beyond the images required for matching.

After verification, a digital certificate is issued to a virtual smart card, linking the verified identity to the onboarding device and activated via a five-digit PIN. Keys and certificates are managed to meet QES constraints, using Digidentity’s secure infrastructure and HSM-based storage, while the mobile device triggers signing actions. eSGN integrates with document tools (e.g., Adobe Sign) via QR-based login and SSO. Strengths include fast self-service onboarding, reduced hardware attack surface, and ETSI compliance; challenges include dependency on having the enrolled smartphone available, PIN usability risks, and uneven global document coverage, with biometrics and broader document support on the roadmap.

• The eIDAS Regulation came into full force in 2016.
• A QES has the same legal standing as a handwritten signature on a physical document.
• Qualified trust service providers listed on the EU Trust List are the only vendors that may issue a qualified electronic certificate.
• Digidentity was founded in 2008 and is based in The Hague, the Netherlands.
• eSGN onboarding uses NFC to read the embedded chip in passports and identity documents and scans the MRZ.
• The onboarding flow sets a five-digit PIN for later use.
• The self-service onboarding process takes approximately three minutes.
• BioID checks selfies for spoofing, deepfakes, video of a video, photo of a photo, and masks.
• A typical smartphone camera is sufficient for BioID’s analysis, and no 3D camera is needed.
• Certificates must be renewed each year to confirm continued control of the mobile device without re-verifying identity documents.

• “No sacrifices can be made for security.”
• “A QES has the highest level of assurance according to eIDAS, and has the same legal standing as a signature made by hand on a physical document.”
• “Signatories are often required to carry a physical security token like a smart card, have access to dedicated smart card readers, use video identification products, or wait hours or days to complete the initial identity proofing required before they may proceed with signing.”
• “By combining remote identity verification with a virtual smart card, signatories to a document can complete the necessary steps on their mobile device themselves and immediately sign a document.”
• “The process is completely self-service, can be accessed any time of day, and takes approximately three minutes.”
• “This detects liveness and completes a 1:1 face match with the biometric photo from the identity document.”
• “If the document has been tampered with, the electronic signature is invalidated and becomes a visible indicator that the document is compromised.”
• “The hybrid app-HSM solution uses the mobile device to trigger actions in the HSM to sign a document.”
• “A typical smartphone camera is sufficient to facilitate this analysis, no 3D camera is needed.”
• “eSGN enables digital signatures in an all digital flow, and organizations looking for an AES/QES that makes a significant effort to unite user-friendly experience with high security will want to consider Digidentity's eSGN.”