Legally binding digital signature

Question

Hand signature on a document is legally binding if not forged.

And apparently, digital signature is also legally binding.

But in cryptographic digital signature, such as PGP, you can revoke your signing key if for any reason you believe that it has been compromised.

Say you have signed a document, and then revoke your key at a later date, is your signature still legally binding?

Say your key has been stolen, and you revoke your key, but the thief uses your key to sign documents anyway, are you legally bounded by the signature that has been made by your impersonator?

Answer 1

A contract is binding if it has been agreed by both sides and is otherwise legal and freely entered into. A signature (handwritten or otherwise) is not required.

However if a dispute arises, either party can use the presence of a signature as evidence that the contract was agreed to. The signature is evidence of the agreement, and the agreement is binding, not the signature.

If your handwritten signature is on a contract that you have not agreed to you would need to explain to the court how this happened: "I was forced to at gunpoint" or "It wasn't written by me but by a forger", for example. The court would then have to decide, on the balance of probabilities if they believe you or not.

It is much the same with digital signatures. The court has to decide if you made an agreement or not. If your digital signature appears on an electronic document that you haven't agreed to, you would need to explain to the court how that happened: "my key was stolen" would be your explanation. If the revocation came after the contract was signed, you would have a much weaker case than if it came before. But the court would need to weigh the balance of probabilities.

But the "key" point here (pun absolutely intended) is that it is the agreement that is binding, and not the signature. If you agree to a contract (and indicate that agreement by digital signature using a key that you later revoke) then you are bound. If you don't agree to a contract (which is signed without your consent using a key stolen from you that you have revoked) then you are not bound.

Answer 2

The answer by James K is pretty much correct for contract law, at least in common-law countries; I am not so sure about the civil-law position.

There are, however, situations in which an actual signature is required. For example when one issues a negotiable instrument, an actual signature is required and is binding, whether any contract is involved or not. Transferring a deed also requires an actual signature, not just an agreement, in many jurisdictions. In some jurisdictions, so does making a will.

In many jurisdictions these can now be done with some form of an electronic signature, and I don't know of any jurisdiction where a cryptographic signature is required for a valid digital signature. (A will is more likely to require a physical signature than most other documents, still.)

Even so, a forged signature is not valid, provided that the evidence shows that it was forged. A cryptographic signature made with a stolen key is forged. A person who revokes a cryptographic signature after using it would still be bound by it, provided that evidence can be presented to show that the authorized person actually made the signature. This would be true even if the person had, by mistake, used a previously revoked key. It is the signer's intent that matters. But others would be less willing to trust a revoked signature.

Making a signature and then revoking the key would not release the signer from an obligation.