Ordinary Users Do Not Understand Digital Signatures

Ordinary Internet users struggle to verify the identity and commitment of others online. Although digital signatures could reliably solve this problem, users rarely use, understand, or verify them. For effective use of digital signatures, their implementation needs to align with ordinary users’ mental models of digital signatures. This paper is the first to explore these mental models through 20 semi-structured interviews. Participants’ mental models of digital signatures were found to be highly context-sensitive and inconsistent within participants. Still, two consistent perceived purposes emerged, where digital signatures are used only for expressing one’s identity, or also for expressing their agreement. We discuss that these ‘It’s me’ and ‘I Agree’ models are an identity-based interpretation of digital signatures. We discuss four emerged obstacles to the adoption of digital signatures with suggestions for future research and pose design recommendations for more usable (1) digital signature tools and (2) secure communication tools in general.