Decrypt, sign, re-encrypt leaves a readable copy on disk. GroupDocs.Signature for Python signs the protected file in place - here are the four password paths and how failures report....Four password paths - keep it, rotate it, and the two that fail Table...unless you are deliberately rotating; the default is the safe one...