Why a passkey signature beats an email link

Two ways to sign

Email-link signing is how most e-signature services work. As DocuSign, Adobe Acrobat Sign and Dropbox Sign describe it on their own pages (as published on October 11, 2026), you receive an email, open the link and sign on the page. DocuSign tells customers that "recipients of your agreements do not need an account to sign with Docusign. Your agreement will be sent by email from dse@docusign.net". Adobe's help center says that when no extra authentication is set, "selecting the Review and sign button in the email opens the agreement for viewing and action". Dropbox Sign's legal page says a signer "must either have login information for Dropbox Sign, or have received in their email account a request for signature". The services then record what happened and seal the finished PDF. Senders can add checks such as access codes, SMS codes or ID verification, depending on the plan, and some cost extra per use.

Passkey signing is how Attest works. The email link still invites you, but the signature is made by your passkey: a cryptographic key only you control, unlocked with Face ID, Touch ID, Windows Hello or the device PIN. Your passkey signs a statement that names the exact document, by its fingerprint (a SHA-256 hash, a short code calculated from the file's contents), and everything you entered on it. Attest checks that signature against your passkey's public key before it records it.

Six situations where the difference shows

As published on October 11, 2026:

What happens	Email-link signing	Your own passkey, on Attest
The email reaches someone else (forwarded, or read in a shared inbox)	Whoever opens the link can sign, unless the sender added a check such as an access code	Before you set up your passkey, your link is what lets you set one up, so keep it to yourself. After that, the link alone can't sign: Attest asks for a passkey registered to your email address
A lookalike page asks you to sign in	A code or password you type there can be captured	Your passkey works only on attest.datahubz.com. On a copycat site your browser has no Attest passkey to offer
The signer later says "I never signed that"	The evidence is the service's record that the link was used, often with an IP address and a time	The evidence is the signer's own signature over the document's fingerprint and their entries, made after their device verified them
Someone edits the document afterward	The service's seal on the finished PDF shows a change	The signature no longer matches the document, the anchored record on a public blockchain doesn't either, and verification fails
You need to prove it without the service	Part of the proof stays with the service: Dropbox Sign, for example, says it "can provide you with the two unique document records"	The proof travels inside the signed copy, with an open-source verifier that works without Attest
The signer's mailbox is taken over	Whoever controls the inbox controls new signing links	Signing in with your email alone can't add a passkey to your key: that takes a passkey you already have or your recovery phrase. But whoever controls your mailbox can still sign in and reset your key, which needs no passkey or phrase (a reset is for someone who has lost both), and so get a new key and passkey in your name. A reset removes your old passkeys, sends documents waiting for your signature back to their senders to release again, and Attest emails the reset to your address. Before you have a key, your invitation is what sets one up. Either way, your Attest account is as secure as your email account, so protect that account

What a passkey adds that a click can't

• A signature only you could make. The private key never goes to Attest: as Apple says of passkeys, "The server never learns what the private key is." Many services' PDF signatures are platform seals instead: Documenso's documentation, for example, says (as published on October 12, 2026) "The signature is applied at the platform level, not by individual signers".
• A present, verified signer. Signing on Attest requires the passkey to confirm you were present and verified, with Face ID, a fingerprint or the device PIN. The check happens on your device, and your face or fingerprint is never sent.
• A signature tied to one document. The statement names the document's fingerprint and your entries, so the signature fits that document and no other.
• A signature tied to one website. WebAuthn, the standard behind passkeys, says a passkey "can only be used for authentication with the same entity (as identified by RP ID) it was registered with", and every Attest signature records the website it was made on.
• Evidence anyone can re-check. The signed statement, the signature, the passkey's public key and the WebAuthn data can be checked with any WebAuthn library. The open-source verifier inside every signed copy checks each signer's passkey signature, the original document, the pages you see and Attest's anchored record on Horizen, a public blockchain, even if Attest no longer exists.

What stays the same

• The invitation is still an email. Each signer gets their own private link, which acts on that one agreement only and never signs anyone in.
• Identity starts from the email address. Each signature is made by a passkey registered to the signer's email address. Attest confirms control of the email address and the passkey, not a government ID.
• The legal category. Both are electronic signatures. What changes is the strength of the evidence you can show.

What it's like for your signers

Signers don't create an account or a password, and they never pay. A first-time signer opens their link, sets up a passkey (one prompt with most passkey providers), and approves with it when they sign. Because the document is end-to-end encrypted, Attest can't give a first-time signer access itself: you're emailed, and you release it to them from the agreement with your passkey, from your phone if you like. On a computer without a passkey, a signer can approve with their phone through the browser's "Use a phone or tablet" option. How to get a document signed by someone who has no account walks through it from the signer's side.

Your first 2 documents are free, in total, and after that the Signing plan is $5 a month for 20 documents.