A different way to sign

Most of the world e-signs by clicking. You open a document, click a signature field, and the platform records your intent along with an audit trail that proves who signed and that nothing changed afterward. That is a valid, enforceable electronic signature, and for the overwhelming majority of business it is exactly the right tool.

The US federal government signs differently. A federal employee, a service member, or many government contractors will reach for a physical smart card, insert it into a reader, and enter a PIN. Behind that simple motion, a cryptographic operation happens on the card itself, producing a genuine digital signature bound to a certificate the government issued after verifying that person's identity. The two cards that dominate this world are the CAC and the PIV. This article explains what they are, how signing with them works, and why it is a categorically different — and stronger — kind of signature. It is general guidance; specific federal signing and acceptance requirements vary by agency and system, so confirm your obligations with your agency's policy and, where documents are contractual, qualified counsel.

CAC and PIV: what they are

Both cards trace back to a single policy: HSPD-12, a 2004 Homeland Security Presidential Directive that mandated a common, secure, interoperable identity credential for federal employees and contractors. The technical standard that implements it is FIPS 201, published by NIST, which defines Personal Identity Verification (PIV).

  • PIV card — the FIPS 201 credential issued to federal civilian employees and contractors across the executive branch. It is a smart card that stores the holder's identity information and, critically, private keys and certificates used for authentication, encryption, and digital signing.
  • CAC (Common Access Card) — the Department of Defense's implementation. It is the standard identification for active-duty military, DoD civilian employees, and eligible contractors, and it is PIV-compatible: a CAC is essentially the DoD's flavor of a PIV card, carrying the same kinds of cryptographic certificates plus DoD-specific data.

Both cards hold certificates issued under a government Public Key Infrastructure — the Federal PKI for civilian agencies, the DoD PKI for the military. That PKI is the trust anchor: when someone signs with a CAC or PIV, the signature can be traced back through a chain of accredited certificate authorities to the government itself.

Why this is a digital signature, not just an e-signature

This is the distinction that matters most, and it is worth being precise about because the two terms are constantly confused. The broader relationship is covered in electronic signature vs digital signature, but here is the short version applied to smart cards.

An electronic signature is a legal concept: any electronic mark made with intent to sign. A click can be one.

A digital signature is a specific technology — a cryptographic technique using public-key (asymmetric) cryptography. The signer holds a private key; signing runs the document (really, a hash of it) through that key to produce a mathematical seal. Anyone can then use the corresponding public key, published in the signer's certificate, to verify two things at once: that the holder of that specific private key produced the signature (identity), and that not a single byte of the document has changed since (integrity). If the file is altered, verification fails.

CAC and PIV signing is a digital signature in the fullest sense, with one powerful extra property: the private key never leaves the card. The cryptographic operation happens inside the smart card's secure chip. The document's hash goes in, the signature comes out, and the private key is never exposed to the computer, the application, or the network. That is why a smart card is so much harder to compromise than a key sitting in a software file — an attacker would need the physical card and the PIN.

In the vocabulary of European eIDAS levels, a smart-card signature backed by an accredited certificate and a secure hardware device is conceptually the same shape as an Advanced or Qualified Electronic Signature: identity and integrity are built into the signature itself, not reconstructed from a log.

How signing with a CAC or PIV actually works

The mechanics, step by step:

  1. Hardware. The signer needs a smart-card reader — built into many government laptops, or a separate USB reader — and the card inserted.
  2. Middleware. Software on the computer talks to the card. On government Windows machines this is often a smart-card mini-driver plus the OS cryptographic layer; cross-platform, it is frequently a PKCS#11 module. This middleware is what lets an application ask the card to sign.
  3. The signing application. Adobe Acrobat and Reader are the workhorses for PDF signing in government, because they natively support certificate-based digital signatures and can drive a smart card. The application presents the document, the signer picks their signing certificate from the card, and confirms.
  4. PIN entry. The card will not perform the signing operation until the holder enters the correct PIN. This is the "something you have" (the card) plus "something you know" (the PIN) that makes it strong two-factor signing.
  5. The cryptographic operation. The application computes the document's hash and sends it to the card. The card signs the hash with the private key on the chip and returns the signature. The application embeds the signature and the signer's certificate into the PDF.
  6. Verification. Any recipient whose software trusts the Federal or DoD PKI roots can validate the signature: confirm the certificate chains to a trusted government CA, confirm the certificate was valid and not revoked at signing time (often via trusted timestamps and revocation data embedded in the file), and confirm the document is unaltered.

The result is a self-contained, cryptographically verifiable signed PDF that carries its own proof of identity and integrity — no external audit log required to establish the basics, though agencies often keep one anyway.

Where CAC and PIV signing fits — and where it does not

Smart-card signing is the norm for signing inside the government's trust boundary:

  • Internal federal documents — memos, forms, official records, and approvals routed among people who all hold CACs or PIVs and whose systems trust the same PKI.
  • DoD and defense workflows — where the CAC is already the universal credential for login, email, and access, extending it to document signing is natural.
  • Certain contractual and compliance documents where an agency mandates certificate-based signatures.

Where it gets awkward is at the boundary with the outside world. A commercial vendor, a citizen, or an international partner does not hold a CAC or PIV and cannot produce one on demand — obtaining these credentials requires being sponsored through a government-controlled issuance process with in-person identity proofing. So a workflow that requires every signer to use a smart card simply cannot include people outside the credentialed population.

This is why many government-facing processes are mixed. Internal parties sign with their CAC or PIV for maximum assurance, while external parties sign through a commercial e-signature platform with strong platform-level identity verification and a full audit certificate. Both are legitimate; they simply sit at different points on the assurance-versus-accessibility curve. If your work touches federal contracting, the neighboring guide on e-signatures for government contractors and the FAR covers where commercial e-signing is accepted in that world, and regulated-record workflows may separately implicate rules like FDA 21 CFR Part 11.

Practical realities and common friction

Anyone who has supported smart-card signing knows it is powerful but finicky. A few realities worth setting expectations around:

  • Middleware and driver issues are the top support burden. A card that will not sign is usually a reader, driver, or browser-integration problem, not a broken card. Keeping the smart-card middleware current matters.
  • Certificate expiration and revocation trip people up. PIV and CAC certificates have finite lifetimes and are revoked when someone leaves or their card is lost. A signature made with a since-revoked certificate can fail validation unless the signing time and revocation status were captured — another reason timestamps matter.
  • Verification depends on trusting the right roots. A recipient outside the government may see a smart-card-signed PDF flagged as "unknown validity" simply because their software does not trust the Federal or DoD PKI roots by default. The signature is fine; their trust store is incomplete.
  • PIN lockout is real. Too many wrong PIN attempts locks the card and requires a reset through the issuing process. This is a security feature, not a bug.

The bottom line

CAC and PIV smart cards represent the high-assurance end of signing. They are not a different flavor of clicking to sign — they are true, cryptographic digital signatures in which a government-issued private key, held securely on a physical card and unlocked by a PIN, produces a mathematically verifiable seal that proves both who signed and that the document is unchanged. That combination of hardware-protected keys, PIN-based two-factor use, and a government PKI trust anchor makes them exceptionally strong.

Their strength is also their limit: only the credentialed federal population can use them, so they excel inside the government's trust boundary and fall away the moment a signer without a card is involved. The practical answer is to use each where it fits — smart-card signing among credentialed parties, and a well-audited commercial e-signature with strong identity verification for everyone else. Understanding which tool the situation calls for is the whole game. See how Hitt Hosting Sign handles identity and evidence or start free.

This article is general guidance on CAC/PIV digital signatures, not legal advice. Federal signing and acceptance requirements vary by agency and system; confirm your obligations with your agency's policy and, for contractual documents, qualified counsel.