Remote Signing Explained: Qualified Signatures Without the Hardware

In short: Remote signing keeps the signer's private key in a secure, certified environment — typically a hardware security module operated by a qualified trust service provider — so people can create advanced or qualified electronic signatures from any device, with no smart card or USB token required.

For years, the highest levels of electronic signature came with a hardware tax: a smart card, a card reader, a USB token, and the support burden that goes with them. Remote signing removes that friction. Instead of holding a signing key on a physical device, the key lives in a secure server environment under the signer's sole control, and the signer authenticates remotely to use it. The result is the same legal strength — including qualified electronic signatures (QES) — delivered through a browser or mobile app.

What is remote signing?

Remote signing, sometimes called server-side or cloud signing, is an approach where the cryptographic key used to sign a document is generated and stored inside a hardware security module (HSM) rather than on a card or token in the signer's hand. When a signer wants to sign, they authenticate to the signing service, prove they are entitled to use their key, and the HSM performs the signature operation on their behalf. The private key never leaves the protected hardware.

How remote signing works, step by step

• Identity is established. Before a person can hold a remote signing key for qualified signatures, their identity is verified to the level eIDAS requires.
• A key is provisioned in the HSM. A private key and qualified certificate are created for the signer inside a certified HSM operated by a qualified trust service provider.
• The signer authenticates. At signing time, the signer proves their identity — typically with a strong, multi-factor method — to unlock the use of their key.
• Sole control is enforced. The service guarantees that only the authenticated signer can trigger their key, satisfying the eIDAS requirement of sole control.
• The signature is applied. The HSM signs the document hash and the signature, certificate and (for long-term validity) a timestamp are embedded into the document.

Which signature levels can you achieve remotely?

Remote signing supports the full range of eIDAS signature levels. Advanced electronic signatures (AES) are straightforward to deliver at scale, while qualified electronic signatures (QES) — the level legally equivalent to a handwritten signature — are achievable when the key sits in a qualified signature creation device (a certified remote HSM) and identity is verified accordingly. The same platform can also produce qualified electronic seals for organisations.

The standards that make it interoperable

Remote signing is not a proprietary shortcut. It is built on open standards: the Cloud Signature Consortium (CSC) API and ETSI Technical Specification 119 432 define how signing applications talk to trust service providers, while PAdES (ETSI EN 319142) governs how signatures are embedded in PDF documents. These standards let an organisation integrate signing into its own systems and switch or combine providers without re-engineering.

Why organisations move to remote signing

• No hardware to distribute or support. Onboarding a signer no longer means shipping a card and reader.
• Sign anywhere, on any device. Browser and mobile signing remove the desk-bound bottleneck.
• Scales to high volumes. Server-side signing handles bulk and automated workflows that physical tokens cannot.
• Stronger key protection. Keys live in certified HSMs, not on laptops or in software.
• Better signer experience. Fewer steps and no drivers means higher completion rates.

Common use cases

Remote signing fits anywhere signatures are needed at scale or on the move: customer contracts and account openings, employment and HR documents, approvals and authorisations, and high-volume back-office signing. Because it supports QES, it also covers the documents where the law demands handwritten-equivalent form.

HOW PRIMESIGN HELPS

primesign enables legally compliant remote signing by combining certified remote signature creation with a seamless user experience. As a qualified trust service provider, primesign securely manages signing keys in certified HSMs, supports strong signer authentication, and delivers qualified electronic signatures (QES) from any browser or mobile device—without the need for smart cards or USB tokens.

Ready to replace hardware-based signing with secure, cloud-powered QES? Talk to primesign about remote signing solutions built for trusted digital transactions.