Signing uses the signer’s private key; anyone with the corresponding public key can verify it. The signature binds the identity to the exact bytes signed: change one bit and verification fails. In practice, signatures authenticate software releases, documents, email (DKIM), code, certificates, and transactions.
Key points
Signing-key protectionA signature is only as trustworthy as the secrecy of the private key — use HSMs or managed signing services for high-value keys.
Chain verificationSignature validation depends on the signer’s certificate and the trust chain behind it; check revocation, expiry, and who issued it, not just “signature valid.”
Important limitationA valid signature proves the key signed the data — not that the signer intended to, that the content is good, or that the key was not stolen before use. Signed malware is still malware.