I've been asked to distribute electronic certificates (they were originally paper), in a PDF format, but I'd like to sign them with gpg or something similar so users can upload them to my site to check that they've not been handed a fake copy.
So, I'd like to sign a PDF file (transparently, the user doesn't need to know about anything) and check if its valid.
You can do it with a separate signature file.
Sign the Document:
% gpg --output doc.pdf.sig --detach-sig doc.pdf
Distribute doc.pdf and doc.pdf.sig
Verify the Document:
% gpg --verify doc.pdf.sig doc.pdf
I don't think this question specifically requests that the original be perfectly unmodified, just that the signature be invisible to users. GPG, by default, signs to the pdf headers where they aren't seen by normal users (but can be read/verified with pdf or pgp software).
Rename the original to a .orig (recommended)
mv doc.pdf doc.pdf.orig
Sign the original:
gpg --not-dash-escaped --armor --output doc.pdf --clearsign doc.pdf.orig
Now you can distribute the signed doc.pdf alone; it's a normal pdf and users won't see the signature. It's just a tiny bit bigger than the original.
Verify it:
gpg --verify doc.pdf
Notes:
The --not-dash-escaped flag avoids problems with PDF headers. In my experience, you need this even if the PDF does not contain LaTex. (source)
I like to use --armor and --clearsign (instead of --sign) because I think it makes the signature user-readable as a header in pdf software, even without PGP support. This might not be true... I couldn't find documentation but that's what's implied by the manpage.
Actually if anyone finds some documentation on GPG's behavior when writing PDF headers, please add some links to this answer.
.orig isn't an official standard, but it's in DIRCOLORS.
