Things to know
What to know before you sign: the national register number, free versus qualified timestamps, and the limits of an advanced signature.
Your national register number is in every eID signature
The Belgian eID non-repudiation certificate contains your national register number (RRN), and that certificate is embedded in every signature it produces. Anyone who receives a signed PDF can read it. Cachet warns about this at startup and in its summary — think about how the signed documents will be distributed.
Free timestamps are not qualified timestamps
The default timestamp authority is free and produces technically valid B-T and B-LTA signatures, but not qualified timestamps in the eIDAS sense. For genuine qualified long-term preservation, point the timestamp URL at a qualified authority — the EU trusted list identifies providers offering qualified timestamping services.
Azure signatures are advanced, not qualified
Azure mode produces an advanced electronic signature (AES). That is appropriate for internal documents, but it is one tier below the qualified signature (QES) the eID card produces. For documents relied on by external third parties, a publicly recognised qualified issuer would be needed.
B-LTA chains need renewing
The archival timestamp chain keeps the evidence provable over time, but for genuine long-term archival that chain has to be renewed periodically. BUILD.md explains what that involves.