The push for paperless bureaucracy has been going on for quite some time, but the circumstances of the past year made the issue even more pressing than it already was.

PDF has played---and continues to play---an important role in this digitalisation process. This is in large part due to the format's reputation for robust, platform-independent rendering, but its easy-to-use, natively supported security features are another key selling point. PDF documents can be encrypted using AES or public-key encryption to keep their contents away from prying eyes, and the PDF specification also includes native support for redacting documents before public release. Last but not least, electronic PDF signatures as a replacement for old-school "wet ink" signatures have been a major factor in moving towards paperless workflows for companies and governments alike.

Document security is a complicated and broad subject, with many different facets that often conflict with one another. In particular, developers of workflows handling sensitive documents regularly face tough judgment calls weighing security requirements against ease of use. The security features in the PDF specification provide a standard framework to respond to these needs. In this talk, we'll discuss how you can leverage PDF to build secure, yet user-friendly document workflows. In the context of digital signing, we'll go over what it means to "trust" a digital signature, and how that trust is validated in practice. In addition, the talk wil touch upon some of the common pitfalls in PDF security that you should be aware of to prevent your documents from being exploited.