Some people in 2026 still print contracts, sign them, scan them and mail them back. That turns a 90-second task into a 20-minute one. And the original proof, the paper, gets lost along the way. eIDAS-compliant digital signatures fix this. SecTepe.Core builds them in, together with PGP/GPG, for a complete workflow.
Three Signature Levels Under eIDAS
- SES (simple electronic signature): any electronic confirmation. It has little value as evidence, but it is enough for many internal workflows.
- AdES (advanced electronic signature): It links clearly to the signer, and its technology makes tampering hard. It fits risk acceptance, internal approvals and supplier T&Cs.
- QES (qualified electronic signature): It has the same weight as a handwritten signature. A qualified trust service provider issues it with a qualified signature certificate. Some contracts require it, for example when the law demands written form.
SecTepe.Core supports all three levels. The UI shows clearly which level is used for which document.
Where PGP/GPG Adds Value
eIDAS sets the legal rules. PGP/GPG is the proven crypto world for email signatures, code signing and backup encryption. SecTepe.Core brings both together, so you don't have to manage keys twice:
- Key hub: Each user has one central keyring with an eIDAS certificate, a PGP key and S/MIME. It is stored in OpenBao.
- The task picks the key: risk acceptance in the ISMS → eIDAS AdES; confidential mail to the auditor → PGP; signing code commits → PGP.
- Lifecycle management: Key renewal, revocation and trust chain updates all run from one place.
Workflow Example: Accepting a Residual Risk
- The risk manager creates an acceptance request in the risk module. The residual risk is written down.
- Top management gets a notice with a link to the request.
- Top management opens the document in the portal, reviews it and clicks "Sign with AdES."
- The platform asks for multi-factor confirmation (FIDO2 key or TOTP).
- The signature is applied. The audit log records the identity, a timestamp and the document hash.
- The signed document goes into a WORM archive (object lock COMPLIANCE). You can still validate it after 10 years.
Long-Term Validation: The Forgotten Detail
A signature that is valid today may be invalid in 10 years. By then, the signature certificate may have expired, and you may no longer be able to check the original trust chain. eIDAS solves this with AdES-LTV (long-term validation). The signed document also holds:
- the certificate status (OCSP/CRL)
- a trusted timestamp from the time of signing
So even when the certificate expires later, you can still prove the signature is valid.
SecTepe.Core applies LTV on its own to all signatures used for risk acceptance, supplier contracts or audit evidence.
OnlyOffice Integration for Shared Documents
Teams write contracts together in OnlyOffice. SecTepe.Core lets you start signature workflows right from OnlyOffice:
- finish the document
- place the signature fields
- send signature requests to recipients
The audit trail holds all editing sessions, the signature timestamps and the final hash anchor.
Compliance Mapping
- eIDAS Regulation 910/2014: the legal basis in the EU.
- BSI TR-03114: a technical guideline for trusted applications.
- ISO 27001 A.5.34: rules for data protection and the protection of PII. Electronic signatures are part of the measures for authenticity.
- ISO 14533: long-term storage of electronic signatures (LTV).
Choosing a Trust Service Provider
For QES, you need a qualified trust service provider (QTSP). In Germany, proven options include D-Trust, T-Systems Trust Center, Bundesdruckerei and Telesec. For AdES, an internal CA is often enough, with OpenBao as the CA manager. The right choice depends on the level of evidence you need and what the recipient expects.
Conclusion
In 2026, digital signatures are basic infrastructure, not a premium feature. Look for a platform that offers eIDAS and PGP/GPG together, with central key management, OnlyOffice integration and long-term validation. It does away with print-sign-scan for good. At the same time, it gives you an audit trail that meets every auditor's wish.