A grounded control guide for remote signature services that use QTSP-managed signing infrastructure, including remote QSCD scope, signer authentication, certificate linking, signature activation, validation, and evidence.
Use it to separate eIDAS remote QSCD requirements from ordinary cloud HSM hosting claims, and to define the records a provider, relying party, or auditor should ask for.
Structured answer sets in this page tree.
Cited legal and guidance references.
Remote signature work under eIDAS is not a generic cloud HSM checklist. The core question is whether a qualified trust service provider is managing a remote qualified electronic signature creation device on behalf of the signatory, and whether the service can prove signer control, certificate linkage, device qualification, validation status, and operational evidence.
Under the consolidated eIDAS text, a remote qualified electronic signature creation device is a QSCD managed by a qualified trust service provider on behalf of a signatory. Article 29 and Article 29a focus on generating, managing, and where permitted duplicating electronic signature creation data for a remote qualified signature creation device.
That means the control record should start with service classification. If the service only hosts keys in a cloud HSM for internal signing, it may still need strong cryptographic controls, but the page should not label it a qualified remote signature service unless the QTSP, remote QSCD, signatory request, certificate, and qualified-service facts are present.
For a server-side remote signature service, ETSI TS 119 431-1 breaks the service into component responsibilities rather than treating the HSM as the whole control. The useful implementation record should show how signing keys are generated, how the signer identity or eID means is linked, how the certificate is linked, how signature activation data is verified, and how keys are deleted or recovered when applicable.
ETSI TS 119 431-2 covers the service component that creates AdES digital signatures. It is relevant when the remote signing service receives documents or hashes, prepares the data to be signed, obtains the digital signature value from the signature creation device, and builds the final signature.
The remote signing control is strongest when the evidence links a particular signer, signing key, certificate, signature session, and explicit authorization to sign. ETSI TS 119 431-1 treats eID means or identity linking as a dedicated component and requires integrity protection for the link between the signer key and the eID means reference or identity.
If authentication is delegated outside the qualified trust service, the record should show the delegation boundary and the assurance basis. The standard recognizes delegated authentication and points to notified eID schemes or the EUDI Wallet at the needed level of assurance as a way to support the required assurance, but the QTSP still needs to show how the external party fits the remote-signing requirements.
A remote signature control record is incomplete if it stops at successful signing. eIDAS validation of a qualified electronic signature requires confirming the qualified certificate at signing time, the issuing qualified trust service provider, the signatory data, the QSCD, data integrity, and the advanced-signature requirements.
Operational validation should therefore keep the trusted-list evidence used to establish qualified status, the certificate chain and status evidence, the validation policy, and the signature qualification result. The European Commission eSignature building block and eIDAS Dashboard context are useful because they point implementers to DSS, the Trusted List Browser, notification tooling, and validation tests.
The evidence pack should be organized around the claim being made: qualified remote signature, advanced remote signature, remote seal, or non-qualified server-side signing. Each claim needs different evidence, and a cloud HSM attestation alone does not prove qualified signature status.
For QTSP-operated services, ETSI EN 319 401 supports baseline trust-service evidence such as terms and conditions, trustworthy systems, stored data authenticity controls, relevant records for legal proceedings and continuity, change communication, incident handling, and service termination planning.
No. eIDAS focuses on qualified electronic signature creation devices and, for remote qualified signatures, QTSP management of the remote qualified signature creation device. A cloud HSM may be part of an implementation, but the eIDAS evidence must prove QTSP service status, remote QSCD qualification, signer control, certificate linkage, and validation results.
Check whether the signing certificate was a qualified certificate issued by a QTSP, whether the private key was held in a QSCD, and whether the remote device management service is a qualified service when Article 29a applies. Then retain the trusted-list and validation evidence for the signing time.
Ask for the qualified service identity, trusted-list status, practice statement or terms, remote QSCD certification evidence, signer authentication and activation controls, certificate status handling, validation report format, incident process, and record retention approach.
Sorena can help turn this remote signature control guide into service classification questions, QTSP evidence requests, validation checks, and implementation records for eIDAS work.
Ask grounded questions about remote QSCD scope, QTSP evidence, signer authentication, trusted lists, and validation using the cited sources on this page.
Review your remote signing workflow, cloud HSM assumptions, validation evidence, and QTSP source gaps with Sorena.
"Trust Service Providers"
"audit data records"
"AdES digital signature creation"
"Trusted Lists"
"Trusted List Browser"
"Requirements for the validation"