The issue isn't the functionality, it's the design of the format. This design will lead to an endless slew of possible attacks. It is just a poor way of doing t

The issue isn't the functionality, it's the design of the format. This design will lead to an endless slew of possible attacks. It is just a poor way of doing things. What you want is to sign the whole file. It looks like the design here is a hack using the existing PDF format instead of adding a container to the PDF. If you want multiple parties signing the same document, you should have a container that allows you to append additional signatures to the container. The idea that you need to have a squiggly line inside the PDF to show that it's valid is really dumb in this context anyways. Instead the PDF reader should show you that "@raul signed this document on 2019-03-06 at 11:47:55 EST, here is his GPG signature", and that's it. No squiggly lines needed.