"Signed documents" are a joke and everybody knows it. As the XKCD goes: How to use PGP to verify that an email is authentic: Look for this text at the

"Signed documents" are a joke and everybody knows it. As the XKCD goes: How to use PGP to verify that an email is authentic: Look for this text at the top -----BEGIN PGP SIGNED MESSAGE----- If it's there, the email is probably fine The abstract only mentions it offhandedly, but I think the least emphasized bug in their paper is actually the most important, because it really drives this point home: "We discovered that on macOS, it is sufficient to include a sig1.xml without any content to force the application to show a security banner stating that the document is protected by a signature" BEGIN PGP SIGNED MESSAGE indeed.