Verification
eIDAS, E-Seals and Signing a DPP
What the eIDAS framework provides, how an electronic seal differs from an electronic signature and how to sign passport data with legal weight.
Signing passport data answers the question "who declared this, and has it changed?" In EU law the framework for that is eIDAS — with one important distinction: natural persons sign, legal persons seal.
The levels
| Level | What it provides |
|---|---|
| Simple electronic signature/seal | Minimal assurance |
| Advanced | Uniquely linked to the holder, changes detectable |
| Qualified | Qualified certificate plus secure creation device; highest legal effect |
For passport publication the practical target is at least an advanced electronic seal; qualified seals are preferred where regulatory declarations carry more weight.
Why a seal, not a signature?
The passport is declared by an economic operator, not an individual. A person-bound signature creates problems when that person leaves. A seal belongs to the organisation and matches corporate continuity.
What should be signed?
- Every passport version should carry its own signature. See audit trails and versioning.
- Supplier declarations should arrive signed where possible. See verifiable credentials.
- Update receipts: who changed what, and when.
Key management
A passport must stay verifiable for the product's expected lifetime — potentially 20 years. Design rules:
- Plan key rotation; old signatures must stay valid.
- Use timestamps to fix the moment a signature was valid.
- Store keys in secure hardware.
- Publish the verification chain so a reader can verify independently.
See EN 18246 data authentication and cyber security for DPP systems.
Relationship to GDPR
A seal belongs to an organisation and contains no personal data. Audit records may include user identities, so their retention and access must be defined. See GDPR and DPP data.
Frequently asked questions
Is signing mandatory?
It becomes a practical requirement once the standard is published and legislation cites it — and it is already a strong trust differentiator.
Can I use a non-EU e-signature infrastructure?
Declarations aimed at the EU market are expected to align with eIDAS. Confirm mutual recognition status with your trust service provider.
Is a qualified seal expensive?
Certificate cost is predictable and paid per organisation rather than per passport, so at volume the marginal cost is negligible.
