There is a spectrum between copy-pasting a picture into a pdf and actually requiring user to bring their own CA-endorsed key material to produce an artifact. Th

There is a spectrum between copy-pasting a picture into a pdf and actually requiring user to bring their own CA-endorsed key material to produce an artifact. The most practical compromise is performing all cryptography on a service provider's environment with HSM and all that and issuing the end user ephemeral certificate on the spot, tied to their email. In the end you can't modify (actually you can, because PDF, but it's a different problem) the data without breaking crypto signature, but identity that is proven by this operation is not government-endorsed. Everybody is mostly fine with a status quo.