What a digital signature actually proves
It helps to separate two things that both get called signing. Placing a picture of your handwriting on a page shows intent, and for everyday agreements that is often enough. A digital signature does something categorically stronger: it uses cryptography to bind a specific certificate to the exact bytes of the document, so the signature stands as evidence of both who signed and that nothing has changed since.
The mechanism is a hash. When you sign, the tool computes a fingerprint of the document and encrypts it with your certificate's private key; the result is embedded in the PDF. A viewer can recompute the fingerprint, decrypt yours with the public key in your certificate, and check they match. If a single byte of the document is altered afterwards, the fingerprints diverge and the viewer reports the signature as invalid — which is exactly the tamper-evidence a drawn signature cannot give you.
Why the green tick depends on trust, not on signing
People often expect a signed PDF to show a green 'valid' badge automatically, and are puzzled when it shows a warning instead. The signature is not the problem — the trust is. A digital signature answers 'has this document been changed?' on its own, but 'can I trust who signed it?' is a separate question that depends on where the certificate came from.
Viewers like Adobe Reader trust a fixed list of certificate authorities. A certificate issued by one of those authorities — after they have verified your identity — produces the automatic green tick, because the viewer already trusts the chain it hangs from. A certificate that does not chain to a trusted authority is treated as unknown until a person explicitly decides to trust it, no matter how sound the cryptography is. That is a policy decision by the viewer, not a flaw in the signature.
Using your own certificate, or a self-signed one
If you already hold a signing certificate, it almost certainly arrived as a PKCS#12 file — a .pfx or .p12 — which bundles your certificate together with its private key behind a password. Upload that and enter the password and the tool signs with it, giving you the trust level your certificate's issuer carries. This is the path to the automatic green tick, because those certificates chain to authorities viewers already trust.
If you have no certificate, the tool can generate a self-signed one for you from a fresh key pair. The resulting signature is genuine and tamper-evident — any later change to the document still breaks it — but because you vouched for yourself rather than a recognised authority, viewers show it as 'validity unknown' until a recipient chooses to trust your certificate. That is fine for internal use, for signing where the other party already knows you, or for adding tamper-evidence to your own records; it is not a substitute for an authority-issued certificate where formal trust is required.
Your key never leaves your device
A private key is the most sensitive thing in this whole process — anyone who has it can sign as you — so it should never be uploaded to a server, and here it is not. The signing runs entirely in your browser: your certificate is read locally, the document is hashed and signed on your own machine, and only the finished PDF is handed back to you. Nothing is transmitted.
That matters both for the key and for the document, which is frequently a contract or a record you would not want sitting in a third party's logs. Because the work is local, you can sign sensitive material without it leaving your control, the tool keeps working offline once loaded, and there is no server that could retain, inspect or leak either your key or the file you signed.