I have a document for a project that I am working on with my team, and I need to digitally sign the document in a way that can be verified by other members of the team. The catch is, internally, we are using PGP (the commercial version, I think). It appears that, for all intents and purposes, PGP is wholly incompatible with any of Microsoft Office's built-in digital signature functions. Ditto for Adobe Acrobat.
This is baffling, because PGP is a defined RFC, 4880, so I would imagine that it is possible for MS to integrate SOME kind of support for either X.509 or PGP. Signing a document using the external PGP software, however, produces a stand-alone *.sig file that has to tag along with the original document for anyone to be able to verify its authenticity. Since I have multiple people that need to digitally sign this document, I have no idea if this means I would need to manage one *.sig for each signee, or if a single *.sig file can hold multiple signatures by different signees.
Is there a solution of some kind that can allow me to digitally authenticate/verify Word or PDF documents using PGP keys amongst members of a team? It'd be great if there is something that can leave a visual mark within the document itself, too.
I figured that if there was a way to export an X.509/PKCS-12 certificate based off of a public PGP key, and then store that certificate in Windows' internal certificate store (certmgr
), then maybe I could get Office to pull from that. But this appears to be impossible. I mean, aren't both technically bog-standard PKI certificates?
Assume that each signee has their own PGP keypair with passphrase and that there is an internal PGP keyserver that everyone can sync to.
Thoughts?