Background scenario:
So we had a problem where our system (Alice's shiny widgets) generated a PDF with a quote amount for 10 widgets. Someone (Eve) took the PDF, altered it to increase the price by 20%, they then presented the PDF as an expense claim to their boss; hoping to pocket the 20% difference! The boss (Bob) knew what the normal price should be, and accused us of price gouging. Very embarrassing for CEO Alice. Fortunately we has a backup copy of the original PDF. Eve 'was let go'...
CEO Alice said they didn't want that to happen again. So CTO Charlie said: 'Fix it with signed PDFs'
My question is, will that help?
Is there anything forcing Bob to check if the PDF is signed?
What stops Eve2.0 from copying the content of the signed PDF, altering it herself, and then signing herself (perhaps with cert named 'Alice's shiny widgetz'?