Back to DashboardIndustriesPhase 5 · Pilots & Migrationintermediate60 min

Trust Services & Long-Term Signatures

Qualified signatures, timestamping and proof of existence, long-term validation and re-timestamping, trust service provider conformity, and the ETSI cryptographic suites that just gained post-quantum modes.

Why this matters: A qualified signature made today may need to be evaluated in 2050 — outliving the certificate, the revocation data, and very probably the algorithm underneath it. That is a migration problem no amount of new-signature planning solves, because the work is proportional to the archive you already have.

Start here: Set how long a signature must stay evaluable in the Signature Longevity Calculator: it shows which degradation stages fall inside that window and when the archive must be re-timestamped.

For your role

Executive / Business Leader
A qualified signature made today may be evaluated in 2050: the Signature Longevity Calculator shows which parts degrade first, and the ETSI standards explorer shows what changed when PQC arrived.
Developer / Engineer
The longevity calculator sets how long a signature must remain evaluable; the ETSI TS 119 312 hybrid combinations step lists the algorithm pairings to implement.
Security Architect
Timestamping, proof of existence, long-term validation and re-timestamping are the mechanisms; the standards supersession explorer shows the same ETSI standard before and after PQC.
IT Ops / DevOps
The longevity calculator and the re-timestamping mechanism define the maintenance a long-lived signature archive needs; the ETSI hybrid table says which combinations conform.
Practice in the Simulation

Under eIDAS, an advanced electronic signature is uniquely linked to its signatory and detects later changes to the data. A qualified signature adds two things: it is created with a qualified signature creation device, and it rests on a certificate issued by a qualified trust service provider. Only the qualified form carries automatic legal equivalence to a handwritten signature across the Union.

That legal equivalence is why this module exists. Once a signature has legal weight, the question stops being “is this cryptographically valid today” and becomes “can a court establish that it was valid when it was made” — potentially decades later.

Scope note. Wallet activation, PID issuance and the eIDAS 2.0 wallet flows are covered in Digital ID; CMS and S/MIME signing mechanics in Email & Document Signing; certificate chain fundamentals in PKI. This module deliberately does not repeat them — it covers what happens to a signature over time, which none of them cover.

Check off all sections and mark this reading done.

Related modules

In the Industry Landscape

Next step

Produce the artifact: Deployment Playbook

This module belongs to phase 5 (Pilots & Migration); Deployment Playbook produces a deliverable of that phase in the Command Center.

Learning module content can be inaccurate. Please double-check its information. Report inaccuracies in PQC Today GitHub Discussions.