Another method you might consider implementing would be identity verification via SMS code. I've experienced this with docusign: https://support.docusign.com/s/document-item?language=en_US&...

It requires you to know the phone number of the signer, but for important stuff you typically do.

Yep, support for SMS verification will be added eventually with ability to bring own Twilio credentials when self-hosting it.

Those are both unfortunatly trivially faked

Signatures are pretty easy to fake too, because basically noone verifies them.

In practice, the security involved only has to reach the "good enough" threshold and not a 100% hack proof level.

And yet it's the standard practice for normal people.

From my research this has 0 legal validity, at least in germany in regards to the EU eIDAS. They are just smoke and mirrors for companies to make them "feel" secure but without cryptographic ensurances (Advanced Electronic Signature) or TLS like Signed Cryptography (Qualified Electronic Signature) this is just as legally binding or not binding as an E-Mail

> just as legally binding or not binding as an E-Mail

Which is legally binding. In Germany most contracts are free-form contracts (Formfreiheit) and only need declarations of intent in the form of offer and acceptance. This can be a handshake or even a head shake.

Or perhaps even an emoji reaction in a text chat, as described elsewhere itt.

Unless you are a qualified lawyer it would be polite to begin a comment like this with IANAL.

IANAL but in the common law world a contract requires 3 things:

* Offer and acceptance

* Consideration (something of value)

* An intention to form legal relations.

Acceptance is, of course, what a signature signifies. Acceptance is "a matter of fact" and thus in reality pretty much anything will do.

Yeah, it’s not like in the spirit of the law you can perform your part of the contract and then get away with saying “I never agreed”.

In the US, we have a federal law that covers electronic contract signing. I believe it’s part of the UCC? (I’m not an attorney, and that area isn’t one I practice with in tech either.)