Numerous state regulations adopt the NCEES model language for the use of digital signatures. This language says, among other things, that the signature must be "capable of verification." It is not clear to me what this means, though I can make some guesses. Is there any authoritative answer as to what, exactly, must be verifiable when using a digital signature to sign an engineering document?
The question mentions numerous states, but I will use Washington State as a defined example.
The state law interpreted guidance in Washington states this:
A Digital Signature has the following properties:
A. It has a hardware or software cryptographic protection (such as a public/private key pair) that is unique to the licensee.
B. It can be independently verified by a third-party certification authority.
C. The Electronic Record to which it is attached is encrypted such that the recipient can verify that the document was uniquely signed by the licensee.
D. The Electronic Record to which it is attached is encrypted such that the recipient can verify if the document has been altered since the licensee signed it.
I haven't seen very many variations in usage. All of the digital signature that I have seen are on Adobe PDFs. Their help goes through the details of how to actually use the signatures, but it also mentions how each part meets the law as stated above.
On this page, the following is stated:
The digital ID contains a private key and a certificate with a public key and more. The private key is used to create the certificate-based signature. The certificate is a credential that is automatically applied to the signed document. The signature is verified when recipients open the document.
When you apply a certificate-based signature, Acrobat uses a hashing algorithm to generate a message digest, which it encrypts using your private key. Acrobat embeds the encrypted message digest in the PDF, certificate details, signature image, and a version of the document when it was signed.
This statement basically meets all of the items as described in the law.
Adobe has a separate page that talks about how the verification works, but that is only more background information stating that it does was is described above.
All of that above is a lot of text that basically says that the entire process works together, i.e. signing and verification are parts of the same general process. There is no one part that is verifiable; either the entire document (signature and document) are verified, or they aren't. If you think about it, there is no use to have one or the other.
As I mentioned in the beginning, I'm sure that there are other available methods/programs, but I have only ever seen the Adobe version in practice.