An open grading scale for signed documents
The Document Trust Grade is an open grading scale for electronically signed documents. One letter, A+ to F, shows how strongly a document proves on its own who signed it and that it has not changed, and how long it will keep proving it without the platform that signed it.
Current version 0.4.0 · pre-release, open for comment · published 2026-10-22A signed document is only worth what it can prove. Most validation tools answer with a technical verdict (passed, indeterminate) that tells a specialist something and everyone else very little. It doesn’t say how strongly the signer is identified, whether the proof depends on the platform that produced the signature, or whether the document will still verify in ten years.
The Document Trust Grade exists to make that legible:
Three questions in strict order: integrity (has it changed?), then trust (does the identity chain to a recognised trust regime?), then durability (will it still verify years from now without anyone's help?). This is a ladder of necessary conditions, not a points total — a file receives the highest grade whose conditions it meets in full, and one failed gate caps it regardless of everything else.
The file proves who signed it and that nothing has changed, on its own, and the proof can be kept alive for decades. Embedded evidence packages and similar additions are shown alongside the grade; they do not change the letter.
All of
This is what a properly signed document looks like. It proves who signed it, when, and that nothing has changed — on its own, offline, without the platform that made it.
All of
An independent third party has proven when this was signed, and it will keep verifying for years.
All of
Verifies today. There is no independent proof of when it was signed, and once the signing certificate expires or its revocation data goes offline, it may stop verifying entirely.
All of
You can prove this file has not changed. You cannot prove who signed it. The result also states the grade the file’s own construction would reach with a certificate from a recognised provider — B or C — so a well-built document on a private root is not confused with a self-signed PDF.
All of
Something was signed. This file cannot prove it. The proof sits with the signing platform, not with you. Nothing here is wrong — it is simply not self-proving.
All of
This document does not prove what it claims. Do not rely on it without going back to the source.
Any of
No letter is issued when there is no signature and no evidence package to assess, or the file cannot be read. This is never shown as F. F means the document was checked and failed; absence of proof is a different statement from disproof.
A validator applying the scale checks every trust source it carries and names the one that vouched for the document, rather than refusing documents outside a preferred list. What differs between regimes is what a positive result legally means — and that sets the highest grade the document can reach.
| Regime | What it is | Legal weight | Ceiling |
|---|---|---|---|
| EU/EEA qualified | Member-state trusted lists under eIDAS Article 22, where the service is granted for qualified certificates. Published by each member state, aggregated by the European Commission. | Qualified signatures have the legal effect of a handwritten signature (eIDAS Article 25(2)); qualified seals carry a presumption of integrity and origin (Article 35(2)). Advanced signatures and seals — including on qualified certificates — carry neither. | A+ |
| Recognised third country | Trusted lists of countries holding an eIDAS Article 14 mutual-recognition agreement — currently Ukraine and Moldova. | Legally equivalent to EU-qualified, by agreement. | A+ |
| EU/EEA non-qualified | On a member-state trusted list, but the service is not granted for qualified certificates. | Supervised; no presumption. | B |
| National regulated | A national trusted list operating outside eIDAS recognition — the Swiss list (ZertES, Swiss Accreditation Service) and the UK list (Information Commissioner's Office). Real supervision, real audit, no EU mutual recognition. | Regulated nationally; no eIDAS presumption. | B |
| Commercial programme | An established commercial trust list: a programme that publishes its admission requirements, requires independent audit of the certificate authorities it admits, and publishes its membership in a form a validator can load. Operated under contract by a private organisation, not under statute. Called a trust list, not a trusted list: under eIDAS, “trusted list” is reserved for lists with a statutory basis. | Contractual, not statutory; no presumption. | B |
| Not recognised | Chains to none of the lists above: self-signed, a private certificate authority, or an unknown issuer. | None. | D |
A document's grade is the lowest of its signatures' grades — a contract is only as good as its weakest party's proof. Each signature also carries its own grade, so the roll-up is never opaque.
A grade is never shown as a bare letter. It always appears with the assurance level, the ETSI form, and the trust regime that vouched for it — the letter carries the legibility, the rest carries the defensibility.
A PDF sealed by an e-signing platform, validated by Tindom. It clears every gate up to the top of the ladder and is then held at B by two separate things — which is the ordinary case, not a failure.
Grade B. Trusted and time-anchored, and it will keep verifying for years — but two separate things stand between it and A, and either one alone would be enough to hold it there. Both are configuration changes on the signing platform's side, not re-architecture.
The scale is only useful if it says what to change. Each entry below is a ceiling a document can hit, what it means, and what would move it up.
Timestamped, but the file does not carry what is needed to verify it on its own later (B-T).
Embed the certificate chain and revocation data at signing time — B-T becomes B-LT. Usually a setting in the signing platform.
The signature alone, with no independent proof of when it was made (B-B).
Add a timestamp from a trusted timestamping authority at signing — B-B becomes B-T, and the document stops depending on a claimed signing time.
An advanced signature or seal, possibly on a qualified certificate, but not a qualified signature or seal in the eIDAS sense.
Issue on a qualified certificate held on a qualified signature creation device (QSCD). This is a change of product with the trust service provider, not a file-format change.
Self-contained, but without archive timestamps the proof cannot be refreshed as cryptographic algorithms age (B-LT).
Apply an archive timestamp from a qualified timestamp service — B-LT becomes B-LTA, and the evidence outlives both the certificate and the algorithms in use today.
The certificate chains to none of the recognised trust regimes — self-signed, a private authority, or an unknown issuer.
Sign with a certificate from a provider on one of the trust lists above. An internal certificate authority cannot reach beyond D, however well run.
The file records that signing happened, but carries no cryptographic signature that can be checked.
Embed a real signature in the document itself (PAdES for PDFs) rather than keeping the proof on the platform. This is the single largest step available — it moves a document from E to a graded rung.
Something was added to the file after signing that changes what the document shows, or that the validation engine cannot classify — or the signature covers only part of the content.
Sign the whole document, and make any later change as a new signed revision. Adding validation data, timestamps or further signatures is fine; editing content after signing is not.
The certificate chains to a list whose ceiling is B — a non-qualified EU/EEA service, a national list outside eIDAS recognition, or an established commercial trust list.
Sign with a qualified certificate from a provider on an EU/EEA Trusted List. The file format is not the limit here; the trust regime is.
The signature is intact and trusted, but the validation engine could not reach a definitive pass — for example because revocation status or a certificate in the chain could not be confirmed.
Embed the full certificate chain and revocation data at signing (B-LT), so the result does not depend on what can be fetched at validation time.
A trusted signature in a form outside the ETSI baseline profiles, so its long-term durability cannot be assessed against them.
Produce signatures to an ETSI baseline profile — PAdES for PDFs, XAdES, CAdES or JAdES otherwise.
A signature is present, but whether the signed content is intact could not be determined.
Check that the file is the original signed version and has not been converted or re-saved after signing.
Meets the ETSI standard in full, but something added after signing changes what the document shows or cannot be classified.
Make later changes as new signed revisions rather than edits to a signed file.
B-LTA, but the archive timestamp that renews the proof is not a qualified time stamp, or it does not validate.
Take the archive timestamp from a qualified timestamp service on an EU/EEA Trusted List. Usually a setting in the signing platform — the same kind of service many already use for the signature timestamp.
The scale is meant to be shaped by the people who produce, validate and rely on signed documents, not only by its steward. Before version 1.0 is when that matters most. Ways to take part, from lightest to most involved:
Send a document you think is graded wrong. This is the most useful contribution right now: the thresholds are still being calibrated, and real files from other platforms and countries are what is missing. Grade it at tindom.se or any validator using the scale, then email the file, the grade it got and the grade you think it deserves to contact@documenttrustgrade.org. Only send documents you are allowed to share. Signed documents often contain personal data; we use them to test the scale and never publish one, for example as a public test case, without your explicit permission.
The data controller for documents you send is Edström Business AB, Sweden. We use them, and the personal data in them such as names and signing details, only to test and calibrate the scale, on the basis of our legitimate interest in a scale that grades correctly. They are kept in our email (Google Workspace) and internal test material, shared with no one outside Edström Business AB, and deleted when no longer needed, at the latest 12 months after we receive them, unless you have agreed to a document becoming a public test case. To have a document deleted sooner, see what we hold, or object, email contact@documenttrustgrade.org; you may also contact the Swedish Authority for Privacy Protection (IMY).
The Document Trust Grade uses semantic versioning. A change that could lower any document's grade is a major version; one that can only raise grades is minor; wording that moves no grade is a patch. Versions 0.x are initial development: the thresholds are still being calibrated and grades issued under them are not a settled assessment. From 1.0 onward every published version is permanent and is superseded, never rewritten.
Every published version keeps its own permanent page, so a grade issued under it can always be checked against the rules that produced it:
The data controller is Edström Business AB, Sweden. We store your email address and the record of your sign-up and confirmation (time and IP address) as proof of consent, which is the legal basis, and keep them until you unsubscribe. The list is hosted by MailerLite, an EU company processing the data in the EU on our behalf. To see, correct or delete your data, or to complain, email contact@documenttrustgrade.org; you may also contact the Swedish Authority for Privacy Protection (IMY).
The commercial programme regime is defined by criteria instead of by naming a single list. It now covers any established commercial trust list: one that publishes its admission requirements, requires independent audit of the certificate authorities it admits, and publishes its membership in a form a validator can load. The ceiling stays at B. A validator states which lists it carries; one that carries no commercial list grades such documents as not recognised, and says so.
Wording only. The text now reads as a standard rather than as one validator’s documentation: criteria refer to the trust regimes the scale recognises instead of “we”; the validation status is defined by ETSI EN 319 102-1 (TOTAL-PASSED) rather than by the constant of one validation library; and the note on qualified validation applies to any validator instead of naming Tindom. The eIDAS Article 25 note is shown once, next to how the scale works, instead of twice.
A+ is redefined. It no longer depends on a closed list of markers — only one of the four could be assessed, and only in one signing platform’s evidence format, which a neutral scale should not privilege. A+ now means everything required for A, at the highest ETSI baseline level (B-LTA), with an archive timestamp that is a qualified time stamp and validates, and no material change after signing. Rung titles corrected: B-LTA is part of the ETSI standard, not beyond it, and A is not the standard "met in full". Embedded evidence packages are still shown with the result but no longer affect the grade.
The published text and the grading code now say the same thing. (1) Signature scope: validation data, timestamps and further signatures added after signing no longer count as content outside the signature — this is how PAdES B-LT and B-LTA are built, and under 0.1.0 it held every such PDF at B. (2) The A+ condition "no post-signing modification" now means no material change, for the same reason. (3) A multi-signature document now reaches A+ only if every signature meets A in full; before, the result could depend on signature order. (4) The B and C criteria list every reason a document lands there, and B requires a timestamp rather than a qualified one — the qualification of the timestamp was never checked. (5) A D now states the grade the file’s own construction would reach with a recognised certificate. (6) Corrected the legal weight of the EU/EEA qualified regime. Released as 0.2.0 because the scale is still pre-release; under the published policy the change is major, since one grade can go down.
First published version of the scale. Pre-release under semantic versioning: the thresholds have not yet been calibrated against a real distribution of documents, so they may still move.
Changes under consideration for a future version, open for comment. How proposals work
Grade how strongly a document proves itself the same way wherever it was signed, and state where that proof is legally recognised on a separate line next to the letter.
Replace the letters A+ to F with AAA, AA, A, BBB, BB, B and D. Same seven rungs, same order, same criteria: only the labels change.
Before version 1.0 the scale goes to an independent review panel. Its job is to challenge the scale: test the thresholds against real documents, point out where a grade is too lenient or too strict, and push for changes the steward would not make on its own. A scale that has only been checked by the people who wrote it has not really been checked.
We are looking for people from signing platforms, trust service providers, relying parties such as public agencies, courts, lawyers and debt collectors, and research. You can nominate yourself or someone else: send the name, their background, and why they would sharpen the scale to panel@documenttrustgrade.org.
How the panel is composed and how its input is handled will be published here before it convenes.
The Document Trust Grade is stewarded by Tindom, an independent validation service that is not a signing platform and does not issue certificates. The scale is published so that anyone can check a grade against the rules that produced it, and so that others — validators, signing platforms, trust service providers and relying parties — can adopt it and help shape it.
Before version 1.0 the scale is open for comment. Comments, corrections and questions are welcome at contact@documenttrustgrade.org.
The text of the Document Trust Grade, every published version and this site, is licensed by Edström Business AB, the company behind Tindom, under Creative Commons Attribution 4.0 International (CC BY 4.0). You may copy, translate, adapt and build on it, including commercially, as long as you credit the source with its version (for example “Document Trust Grade v0.4.0, documenttrustgrade.org”), link to the licence, and say if you changed anything. The rules themselves are free for anyone to implement; no permission is needed to grade documents with them.
Use of the name. Call a grade a Document Trust Grade only if it was computed according to an unmodified published version, and state which version (for example “Document Trust Grade A, v0.4.0”). Adapted or extended scales are welcome, but they must not be presented as the Document Trust Grade and should say what they change. This keeps the name meaning the same thing wherever it appears. Questions about use: contact@documenttrustgrade.org.